<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="auto">I agree with some of the other commenters - security is not an area ARIN should be actively reinventing.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Simple is good when protected by a trusted layer (HTTPS). Well, sorta trusted, but we all know its limitations fairly well by now. </div>
<div dir="auto"><br>
</div>
<div dir="auto">That proposed change seems simple and harmless enough, but I think the point here is, please stop iterating on a home-grown design.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Instead, allocate resources to a v<next> API that relies on some well-established, pre-existing security architecture in the field that fits both ARIN and the community adequately.</div>
<div dir="auto"><br>
</div>
<div dir="auto">We all like things where adding it to our automation looks like "import securitymodule;" at the top of our scripts or "-loverride_lib" in our makefiles. (Yes, I'm exaggerating a bit here. But pre-existing architectures tend to have pre-existing
implementations and sample code and documentation.)</div>
<div dir="auto"><br>
</div>
<div dir="auto">-Adam</div>
<div><br>
</div>
<div dir="auto" id="ms-outlook-mobile-signature">Get <a href="https://aka.ms/AAb9ysg">
Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> ARIN-consult <arin-consult-bounces@arin.net> on behalf of John Curran <jcurran@arin.net><br>
<b>Sent:</b> Friday, August 9, 2024 8:44:49 AM<br>
<b>To:</b> Jo Rhett <geek@jorhett.com><br>
<b>Cc:</b> <arin-consult@arin.net> <arin-consult@arin.net><br>
<b>Subject:</b> Re: [ARIN-consult] Consultation on API Key Handling</font>
<div> </div>
</div>
<div style="line-break:after-white-space"><br>
<div>
<blockquote type="cite">
<div>On Aug 8, 2024, at 7:48 PM, Jo Rhett <geek@jorhett.com> wrote:</div>
<div>
<div style="line-break:after-white-space">
<div style="line-break:after-white-space">
<div><br>
</div>
There's no reason to build something raw and native. There are dozens of robust, well-tested security frameworks for authentication that are implemented by every platform and language already. OAuth 2, JWT, OpenID Connect, ...
<div><br>
</div>
<div>Yes, those align with (but are greater than) plaintext headers. Don't go creating a unique model unless none of the well-established, widely used frameworks won't meet the needs.</div>
</div>
</div>
</div>
</blockquote>
<br>
</div>
<div>Jo - </div>
<div><br>
</div>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px">
<div>Interesting thoughts - this consultation primarily focuses on whether ARIN should improve key handling for its existing deployed APIs, but you raise some excellent questions. </div>
<div><br>
</div>
<div>To be clear, you’re advocating for ARIN to switch its API authentication towards a more common and accepted authentication framework (e.g. OAuth 2) rather than investing in improving the key handling for the existing RESTful API’s? If that’s the case,
are you recommending that the existing support for key-based API authentication be deprecated, or simply maintained as-is? </div>
</blockquote>
<div><br>
</div>
<div>Thanks!</div>
<div>/John</div>
<div><br>
</div>
<div>
<div>John Curran</div>
<div>President and CEO</div>
<div>American Registry for Internet Numbers</div>
</div>
<div><br>
</div>
</div>
</body>
</html>