One of the personal projects I've been thinking of working on is writing a Flickr uploader for Android. I purchased a G1 running Android so that I could develop for it, and a Flickr uploader seems easy enough to start with. Plus, I've been wanting to do just that as I take photos with my phone, so it would be handy to have.
So I head over to read up on the Flickr API and find out that I've got to register for an API key. Once registered, I find that I've got both a public and "secret" API key.
It looks like several "secure" API calls have to be signed by your secret key in order to work with Flickr.
But, what if I want to distribute this application? Does that mean I have to distribute my secret key along with it? It's not very "secret" at that point, then, is it?
It looks like the only thing you need to sign is a list of the names of arguments that you're passing to a particular API call. As a compromise, I could pre-sign all method calls that my application needs to make, and distribute only that. That's better than distributing my secret key itself, but anyone who inspects my application can still find those method signatures and use them to impersonate calls from my API key.
Is this (pre-signing all method calls) how people actually use this API?
What sort of security is this supposed to offer? It seems like an awful lot of effort for seemingly little gain.
Subscribe to:
Post Comments (Atom)
"It looks like the only thing you need to sign is a list of the names of arguments that you're passing to a particular API call. As a compromise, I could pre-sign all method calls that my application needs to make, and distribute only that."
ReplyDeleteNo, you have to sign names of arguments and the arguments themselves:
"concatenate the shared secret and argument name-value pairs"
I also find this very very weird. I guess they're only thinking about web-based services, where the code is only going to run on the server.
"