On: Amazon Web Services signature version 1 is insecure

[tptacek]

First, you're talking about a nonce, not a salt. You'd be a happier person if you took the word "salt" out of your CS vocabulary.

Second, the vulnerability here isn't password cracking; it's that AMZN verifies the signature on canonicalized data, but operates on non-canonicalized data.

[kirse → tptacek]

Thanks! I understand the Amazon vulnerability fully, I was just referring to my own web-app development.

It's not an issue though because I don't do the key/value pair splitting as they do.

[tptacek → kirse]

Why are you "signing" your data at all? You're doing it wrong. Use SSL to secure the whole transport; use form or HTTP auth to make sure you know who you're talking to.

[cperciva → tptacek]

Signing requests with an HMAC provides end-to-end authentication, which is vastly superior to transport-level authentication such as HTTP auth.

[tptacek → cperciva]

You skipped the HTTPS part of my recommendation, which is vastly superior to homebrewed HMAC.

[cperciva → tptacek]

HTTPS is irrelevant to what I said. End-to-end authentication is better than transport-level authentication. Using an HMAC to sign requests and then sending those signed requests over HTTPS is better than using HTTP auth over HTTPS.

[tptacek → cperciva]

Yes, but what you said is irrelevant to what I said, and so we are at an impasse. =)