October 2020 Summaries

This article provides an overview of three authentication protocols: Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Extensible Authentication Protocol (EAP). PAP is a simple, easily understood protocol that sends sensitive credentials repeatedly in plaintext, making it vulnerable to eavesdropping and man-in-the-middle attacks. CHAP requires both the server and client to run passwords through a hash function along with an OTP, offering more security than PAP but still sending payloads in cleartext. EAP is a flexible authentication framework that supports 40 different methods, including EAP-MD5, EAP-TLS, and EAP-FAST. Each method has its own pros and cons, with EAP-TLS being one of the most secure options.

This post discusses guidelines and best practices for building webhooks into an application. Webhooks are reverse APIs that actively send out data to other systems based on internal triggers, requiring persistence of information on where the data is sent and its status. The process involves creating a service that makes POST requests to arbitrary endpoints, using a database to store endpoints and associated metadata, and providing a form for developers to subscribe. Handling authentication with webhooks requires verifying the developer's ownership of the endpoint and managing security by signing and encrypting payloads. Error handling, ordering, and duplicates should be considered when sending events. Finally, development tips such as testing with live URLs, sample events library, logging, separating events from webhooks, and using streaming event-based databases are suggested for a smoother implementation process.