On: Amazon Web Services signature version 1 is insecure

[cperciva]

Signing requests with an HMAC provides end-to-end authentication, which is vastly superior to transport-level authentication such as HTTP auth.

[tptacek → cperciva]

You skipped the HTTPS part of my recommendation, which is vastly superior to homebrewed HMAC.

[cperciva → tptacek]

HTTPS is irrelevant to what I said. End-to-end authentication is better than transport-level authentication. Using an HMAC to sign requests and then sending those signed requests over HTTPS is better than using HTTP auth over HTTPS.

[tptacek → cperciva]

Yes, but what you said is irrelevant to what I said, and so we are at an impasse. =)