News for hackers. Stuff that matters.

A comment on Pin is Australia’s first all-in-one payment API. Parent comment

Re:Pin is Australia’s first all-in-one payment API by Aqua_Geek on Thursday June 07, 2012 @11:41AM (#4079525)
> Are you attempting to reencrypt the parameters with another key? If so then why run that through https?

I think they are talking about generating a hash from all of the parameters in the request + a secret, pre-shared key. Doing so prevents MITM attacks from changing the parameters.

IIRC, Amazon does this (among many others).

[ Parent | on HN ]
Re:Pin is Australia’s first all-in-one payment API by jbrendel on Thursday June 07, 2012 @01:03PM (#4080063)
Exactly. Have a look here for some information on how to do this: http://www.thebuzzmedia.com/designing-a-secure-rest-api-with...
[ Parent | on HN ]
Re:Pin is Australia’s first all-in-one payment API by Bjoern on Friday June 08, 2012 @01:43AM (#4082875)
This article also inspired me to lockdown my own API I designed, its really good advice. The question is only, they wanted to provide a very simple interface, what is the right trade-off security vs. developer UI?
[ Parent | on HN ]