Hacker News Reader

I enjoy reading this kind of article about lousy security, because I say to myself "Wow, that was lousy!" and laugh. BUT I still don't know how I could avoid this. I genuinely ask: could anyone share with me the "2016 Guide of the best pratices for securing an API/ a web app"?

View on HN

TLS + Client Certs + EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

You forgot to mention +[Vault|CFSSL|XYZ] for cert management.

I can find what CFSSL[1] and Vault[2] are, but not XYZ in this context.

Also, all of this can be done with plain openssl, there is no need for additional tools.

[1] https://blog.cloudflare.com/introducing-cfssl/ [2] https://www.vaultproject.io/intro/

Reply on news.ycombinator.com