Hacker News Reader

As far as I can tell the signature applies only to the date header. Which means that if an attacker can intercept a signed request they can swap in any request of their own without having to change the signature at all. And the server will interpret it as a legitimate signed request.

View on HN

They are using TLS to assume that the client authenticates the server is who it says it is -- if you can man in the middle TLS, there are lots of other possible exploits besides this signature one.

Thanks. It's not clear to me from the post that it's using TLS but that would make sense. Though if requiring TLS I wonder why not just use basic auth since it's simpler and since TLS would protect the password.

One of the things that's neat about, say, OAuth's MAC authentication, is that it works over plain old HTTP without TLS. Likewise for the AWS API's signature-based security scheme. Sounds like I erroneously assumed that this was aiming to do similarly.

Reply on news.ycombinator.com