undefined | Better HN

0 pointsTownley1y ago0 comments

If a malicious party has access to the API key, it should be revoked regardless

0 comments

Of course. But I think the poster above was referring to just posting random keys to the server.

In other words I don't have your key, or any key, but I have "all of them".

The correct response to this though is that "there are lots of keys, and valid keys are sparse."

In other words the jumper of valid keys that could be invalidated in this way is massively smaller than the list of invalid keys. Think trillions of trillions to 1.

ncallaway1y ago

Which, like, if posting random keys has any realistic plausibility of collision, malicious revoking of keys is the least of your concerns.

People could just hit important data fetch endpoints with random keys, until they find one that’s good, and then have a compromised account.

makeitdouble1y ago

Good point. Presented that way I am seeing more positives to their policies, in particular if a vulnerability was unearthed by the invalidation quirk it's a way better way to find out than any other way.

numpad01y ago

It's wrong that clients are authenticated with just the random generated username. But it's also what everyone do.

j / k navigate · click thread line to collapse