Ask HN: What kind of authentication model do you use for your API service?

Re:Ask HN: What kind of authentication model do you use for ... by hussfelt on Wednesday August 08, 2012 @02:44AM (#4354288)

Hey kuasha!

That sounds interesting, how would you implement that on an API level in a good way? I mean, the clients applications will most probably do automatic transactions all the time.

Are you thinking something like time-based sessions, which you have to authenticate on both ends - with a PK?

[ Parent | on HN ]

Re:Ask HN: What kind of authentication model do you use for ... by kuasha on Wednesday August 08, 2012 @09:14AM (#4355311)

2FA can use smart card- The device with TPM capability may work as a virtual smart card- This video is interesting- http://www.youtube.com/watch?v=QmTpdZAC4_s -

But Yes, I have to admit, for API, this may be overkill-

[ Parent | on HN ]

Re:Ask HN: What kind of authentication model do you use for ... by hussfelt on Wednesday August 08, 2012 @09:40AM (#4355466)

So you would implement like a virtual smart-card in the Client application end that then communicates with the API in our end and authenticates?

I also think this might be a bit overkill - maybe something for real enterprise apps... :-)

But it's a cool thought!

Thanks for sharing!

[ Parent | on HN ]