{"action":"created","issue":{"url":"https://api.github.com/repos/markbao/speakeasy/issues/24","labels_url":"https://api.github.com/repos/markbao/speakeasy/issues/24/labels{/name}","comments_url":"https://api.github.com/repos/markbao/speakeasy/issues/24/comments","events_url":"https://api.github.com/repos/markbao/speakeasy/issues/24/events","html_url":"https://github.com/markbao/speakeasy/issues/24","id":37887805,"number":24,"title":"Sending secret key over HTTPs","user":{"login":"kaosdynamics","id":867011,"avatar_url":"https://avatars.githubusercontent.com/u/867011?v=3","gravatar_id":"","url":"https://api.github.com/users/kaosdynamics","html_url":"https://github.com/kaosdynamics","followers_url":"https://api.github.com/users/kaosdynamics/followers","following_url":"https://api.github.com/users/kaosdynamics/following{/other_user}","gists_url":"https://api.github.com/users/kaosdynamics/gists{/gist_id}","starred_url":"https://api.github.com/users/kaosdynamics/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaosdynamics/subscriptions","organizations_url":"https://api.github.com/users/kaosdynamics/orgs","repos_url":"https://api.github.com/users/kaosdynamics/repos","events_url":"https://api.github.com/users/kaosdynamics/events{/privacy}","received_events_url":"https://api.github.com/users/kaosdynamics/received_events","type":"Organization","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-07-15T14:22:47Z","updated_at":"2015-03-11T19:44:41Z","closed_at":null,"body":"Secret key is supposed to be unpredictable and kept secret because anyone who knows the secret can generate the code at any time.\r\n\r\nSpeakeasy sends it over an [HTTPs request](https://github.com/markbao/speakeasy/blob/master/lib/speakeasy.js#L220). \r\n\r\nWhile we're sending it to Google - can we trust it? Some might say 'yes', some might say 'no'; infosec says 'no' - we're sending it over an HTTPs **GET** request: even if it is a request over *SSL*, it doesn't secure the data passed via GET, and so the secret is exposed while it gets transmitted to any party who has control over the network.\r\n\r\nSpeakeasy should thus try to generate a QR-Code on the server side."},"comment":{"url":"https://api.github.com/repos/markbao/speakeasy/issues/comments/78354703","html_url":"https://github.com/markbao/speakeasy/issues/24#issuecomment-78354703","issue_url":"https://api.github.com/repos/markbao/speakeasy/issues/24","id":78354703,"user":{"login":"gcochard","id":2836237,"avatar_url":"https://avatars.githubusercontent.com/u/2836237?v=3","gravatar_id":"","url":"https://api.github.com/users/gcochard","html_url":"https://github.com/gcochard","followers_url":"https://api.github.com/users/gcochard/followers","following_url":"https://api.github.com/users/gcochard/following{/other_user}","gists_url":"https://api.github.com/users/gcochard/gists{/gist_id}","starred_url":"https://api.github.com/users/gcochard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gcochard/subscriptions","organizations_url":"https://api.github.com/users/gcochard/orgs","repos_url":"https://api.github.com/users/gcochard/repos","events_url":"https://api.github.com/users/gcochard/events{/privacy}","received_events_url":"https://api.github.com/users/gcochard/received_events","type":"User","site_admin":false},"created_at":"2015-03-11T19:44:41Z","updated_at":"2015-03-11T19:44:41Z","body":"If you are using https, then nobody should be able to MITM the connection. if they do MITM, the secret will be compromised."}}