CODEWITHSUNDEEP
restasp.net-web-apiencryptionpassword-encryption
Cody
Cody

Reputation: 127

Encrypted Password Accessible via API Call, Is this Secure?

I am working through some security concepts right now and I was curious if this method has been tried and/or if it is safe taking into consideration "Brute Forcing" is still possible.

Take for example a Microsoft WebAPI Template in Visual Studio where you access a endpoint using a "GET".

Is this a secure practice?

Thanks for indulging me and look forward to your responses.

EDIT: Added Further Clarification with Image to Help Illustrate

enter image description here

Upvotes: 1

Views: 1556

Answers (1)

Severin Jaeschke
Severin Jaeschke

Reputation: 671

Suppose the following 2 Scenarios:

  1. Communication between Server and Client

    a. Your Server serves the Client application with an encrypted password.

    b. The Client can request any password.

    c. The passwords are encrypted with a shared Key that is known by both server and client application

As James K Polk already pointed out:

A knowledgable Attacker can and will analyse your deployed application and at some point will find your hardcoded decryption key ("KeyValue"). What prevents him from requesting every password that is stored on the Server?

Rule of thumb here would be: "Do not trust the client side."

  1. Communication between Server and Server

    a. You have 2 server applications. Application A is acting as some kind of database server. Application B is your Back-End for a user application of some kind.

    b. Application A serves paswords to any requester, not only Server B. With no type of authentication whatsoever.

    c. Confidentiality is guaranteed through a shared and hard-coded Key.

I think you are trying to overcomplicate things hoping that no one is able to piece together the puzzle.

Someone with enough time and effort might be able to get information about your server compilation and/or be able to get the Code of Application B. Which again defaults in the scenario of 1. Another point is that there are enough bots out there randomly scanning ips to check responses. Application A might be found and even-though they do not have the shared key might be able to piece together the purpose of Application A and make this server a priority target.

Is this a safe practice?

No. It is never a good idea to give away possibly confidential information for free. Encrypted or not. You wouldn't let people freely download your database would you?

What you should do

All Authentication/Authorization (for example a user login, that's what I expect is your reason to exchange the passwords) should be done on the server side since you're in control of this environment.

Since you didn't tell us what you're actually trying to accomplish I'd recommend you read up on common attack vectors and find out about common ways to mitigate these.

A few suggestions from me:

  1. Communication between 2 End-points -> SSL/TLS
  2. Authorization / Authentication
  3. Open Web Application Security Project and their Top 10 (2017)

Upvotes: 1

Related Questions