Timeline for What are practical risks of http (not https) in server-to-server communications
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 25, 2012 at 16:26 | comment | added | Colette Chamberland | The simple point I was trying to make was does the cost of losing information out way the cost of securing it. In most cases, it's far cheaper to secure it in the first place than to deal with disaster recovery (including tarnished reputation) if data is breached. | |
| Feb 25, 2012 at 12:31 | comment | added | ewanm89 | I would add that one does not neccersarrily need to buy cert authority signature if one gives a self signed cert to the admin of the other server via a side channel (if the companies are setting up private communications channels in some sort of simple partnership). If it's a lot of different servers calling the endpoint like for twitter then this becomes unfeasible to manage in most cases (it can be done). | |
| Feb 25, 2012 at 5:07 | comment | added | codingoutloud | Regarding "how much will it cost you if someone steals data from company a or company b - if its more than the cost of buying a cheap SSL cert then it's justified." Respectfully, I do not believe a proper model can be that simple. Is it not also a function of the probability of compromise? This was the thrust of the question "How does one reason about the associated risk?" | |
| Feb 25, 2012 at 2:10 | comment | added | codingoutloud | Thank you for the response. Why do you think Posterous et al allow their callers to expose a key in the clear? I can only guess they did some cost/risk tradeoff and decided it was okay to allow. Other APIs, such as from Twitter and Twilio, only appear to offer secure endpoints. | |
| Feb 24, 2012 at 22:37 | history | answered | Colette Chamberland | CC BY-SA 3.0 |