prefixed-api-key
Dev tools
api key library
SHOW HN2022
100points
54comments
#612of 2,570 in 2022
Top 24%of 2022 by points
How HN took it
MixedNo clear lean
5 positive, 6 neutral or asking, 2 mixed, 9 critical, out of 22 comments about the project. Thread score -0.10.
Design: 2 for, 1 againstExecution: 0 for, 3 againstPrivacy: 0 for, 3 againstIdea: 2 for, 0 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Prefix enables secret scanning and easy leak detection
From 2 comments
It's the issuers company or product name. GitHub for example prefix their tokens with "gh_" which makes it easy to scan for tokens uploaded to repos or even across the web if…
bluehatbrit on HNIf you are prefixing it, why not prefix it with a full domain name? mycompany_com_BRTRKFsL_51FwqftsmMDHHbJAMEXXHCgG is not much longer than…
remram on HN
Base58 is easy to copy and double-click select
From 2 comments
from the RFC: > Base58 is designed with a number of usability characteristics in mind that Base64 does not consider. First, similar looking letters are omitted such as 0 (zero),…
__sy__ on HNAuthor here: I was curious what HN would think of this token style, we're currently using it for getseam.com . I think it has a lot of advantages over other token styles (e.g.…
seveibar on HN
Clear, useful design with a documented README
From 2 comments
Couple comments upon looking at the actual code: - You can promisify randomBytes once and reuse it rather than twice for every invocation - There shouldn’t be a default value for…
koolba on HNThanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HN
Objections
Timing-unsafe hash comparison and unsafe split parsing
From 3 comments
Couple comments upon looking at the actual code: - You can promisify randomBytes once and reuse it rather than twice for every invocation - There shouldn’t be a default value for…
koolba on HNI don't follow what the security property is of involving sha256 against the b58 encoded value? If it serves as a checksum against tpyoss, wouldn't one wish to include the…
mdaniel on HNThanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HN
Base58 is unnecessary and slow to decode compared with base32 or base62
From 3 comments
Don’t use base58. Even bitcoin, which originated or at least popularized base58 has moved away from it. They are a pain to encode and decode, with a naive implementation…
adastra22 on HNUsing base58 here strikes me as simply unnecessary. You could just use the base58 alphabet and directly generate random strings in that alphabet, easily and cheaply. The only…
formerly_proven on HNThe RFC doesn't mention an important drawback of base58, which is that the computational cost of encoding or decoding it is quadratic in the length of the input -- unlike base64,…
teraflop on HN
Default key prefix and underscores in prefix cause problems
From 2 comments
Thanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HNCouple comments upon looking at the actual code: - You can promisify randomBytes once and reuse it rather than twice for every invocation - There shouldn’t be a default value for…
koolba on HN
Underscores break double-click selection on iPhone
From 1 comment
On iPhone the long-press-to-select doesn’t cross the underscore boundary, so you end up just selecting part of the token. Maybe you can do without those underscores?
joshuawarner32 on HN
Requests
Use a slow hash such as bcrypt, scrypt or argon2 for the long token
From 2 comments
Thanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HNWhat meaningfully changes the requirements is that takes many more attempts to brute force an API key because they're longer. I'd consider using a weaker bcrypt/scrypt/argon2 for…
benatkin on HN
Validate the prefix and avoid split-based parsing
From 2 comments
I don't follow what the security property is of involving sha256 against the b58 encoded value? If it serves as a checksum against tpyoss, wouldn't one wish to include the…
mdaniel on HNCouple comments upon looking at the actual code: - You can promisify randomBytes once and reuse it rather than twice for every invocation - There shouldn’t be a default value for…
koolba on HN
Rename short token and long token to clearer terms
From 2 comments
Thanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HNThanks for sharing! As somebody who has been bitten before by copy-pasting a key I appreciate that as the headlining benefit :) Thoughts from an ergonomic perspective: - Base58…
jffry on HN
Questions
Why base58 was chosen
From 1 comment
Why base 58? I've never even heard of base 58.
anm89 on HN
Why store a hash of the long token instead of signing the short token
From 1 comment
Nice work! May I inquire as to the design decision behind storing a hash of the long token server-side for verification of the long token, versus digitally signing the short…
tetch on HN
Whether the prefix should include a domain name
From 1 comment
If you are prefixing it, why not prefix it with a full domain name? mycompany_com_BRTRKFsL_51FwqftsmMDHHbJAMEXXHCgG is not much longer than…
remram on HN
Alternatives named
Stripe-style prefixed tokens
From 1 comment
Very cool, I use something similar but a fixed length for the prefix and uppercase Basically a copy of stripe tokens
godmode2019 on HN
pika Snowflake-based IDs
From 1 comment
I created a similar project recently! Main difference is that I use base64 to encode unique Snowflake IDs, which are timestamped: https://github.com/hopinc/pika :)
phineyes on HN