On Tue, 12 Mar 2013 08:10:21 +0100
Pierre-Yves Chibon <pingou(a)pingoured.fr> wrote:
On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
> A question for this series. If I understand it correctly, the
> api_login is just another random generated string, right? Would you
> please elaborate a bit more on why having separate logins is good?
Yes it is, (with the addition that that the part before '##' is a
based64 of 'copr').
I think the basic idea here is to reduce even more the possibility of
brute force since one would have to do it for both the api token and
the username. Seth, do you see another interest for it?
It also seems to be the approach taken by cloud plateform and by oauth
system (if my understanding is correct).
That's correct. I think the idea is that if someone discovers your
token they don't discover who owns it but if we find someone using that
token username somewhere else - we can trace back what app it came from.
-sv