a suggestion

[livibetter]

Hi,

First I am not an expert of security, but I am thinking these:

About the authentication of API, I think it's no secure enough.
Because HTTP 1.1 Basic Auth has no encryption, if just send md5(pass)
and the user uses lazy password, or short password, then the password
will be found soon.

I suggest it to be

http://user:md5(pass+email)@twitxr.com/api/rest/method?param1=value&param2=value

That will be longer, and prevent from lazy password problem.

Second thing is the website doesn't support HTTP over SSL while
logging process. Although it uses md5 hash before sending login
information, it's still not secure. The reason is the same as
mentioned above.

[livibetter]

I think I made a big mistake.

If someone can intercept what is sending to Twitxr:
http://user:md5(pass+email)@twitxr.com/api/rest/method?param1=value&p...

This won't help. Someone can use http://user:md5(pass+email)@twitxr.com/
with their own method and parameters

It should be something like

http://user:md5(pass+email+/api/rest/method?param1=value&p...
)@twitxr.com/api/rest/method?param1=value&p...

However this is still not safe, they can keep sending that. Digest
authentication may help.

On Feb 20, 11:18 pm, livibetter <livibet...@gmail.com> wrote:
> Hi,
>
> First I am not an expert of security, but I am thinking these:
>
> About the authentication of API, I think it's no secure enough.
> Because HTTP 1.1 Basic Auth has no encryption, if just send md5(pass)
> and the user uses lazy password, or short password, then the password
> will be found soon.
>
> I suggest it to be
>

> http://user:md5(pass+email)@twitxr.com/api/rest/method?param1=value&p...

[Albert (twitxr.com founder)]

We see your point and agree that our current API auth scheme is quite
weak several webapps are using something similar.

We are studying the possibility to switch to an 'auth tokens' based
scheme that wouldn't require anyone to send his password on any API
call (Flickr,Facebook among many others are using that)



Albert

On 20 feb, 16:34, livibetter <livibet...@gmail.com> wrote:
> I think I made a big mistake.
>
> If someone can intercept what is sending to Twitxr:http://user:md5(pass+email)@twitxr.com/api/rest/method?param1=value&p...
>

> This won't help. Someone can usehttp://user:md5(pass+email)@twitxr.com/