<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Like Adam I am not sure of the constraints you are working under or exactly what you are trying to do. So this is a guess at restating it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You have a website running on a server whose security is questionable.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The user in their browser initiates an action that you wish to have ACID properties (Atomic, Consistent, Isolated, Durable) as well as CAINE properties (Confidentiality,
Integrity, Authenticated, Non-Repudiation, Encrypted). Throw enough bull stuff acronyms around and your client may be impressed enough to allow you to do things the right way.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You might try OWASP.org and the articles there. If nothing else you may be able to collect enough examples of hacks to scare your client into acknowledging that
the Internet really can be a scary place. Another resource is RFC1825 which discusses Key Management and other architectures involved in creation of secure services of IP.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You also might think of architectures like what Adam referred to where the webserver passes the actual secure work off to another server with better security.
Typically the second server will only accept connections from the web server(s) it knows - which limits the attack surface exposed on your WordPress site.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Good luck with your attempt to educate your client.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:#1F497D">Phil Robare<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Chicago [mailto:chicago-bounces+proba=allstate.com@python.org]
<b>On Behalf Of </b>Adam Forsyth<br>
<b>Sent:</b> Saturday, May 14, 2016 4:55 PM<br>
<b>To:</b> The Chicago Python Users Group <chicago@python.org><br>
<b>Subject:</b> Re: [Chicago] Secret stuff: additional detail<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Leon,<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">If you're saying you'd need the secret key to be present client-side in the customer's web browser, then no, that isn't secure.<o:p></o:p></p>
</div>
<p class="MsoNormal">You need a server-side component, or you need to get some sort of one-time use, limited scope key that can only be used to take the action the customer is permitted to take -- and whether or not that's possible depends on what the API is
you're interacting with.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sat, May 14, 2016 at 4:40 PM, Leon Shernoff <<a href="mailto:leon@mushroomthejournal.com" target="_blank">leon@mushroomthejournal.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">@ my question of 4:05pm<br>
<br>
I should also add that this is a WordPress site, so it's not a situation where I can do things with the server's system itself. :/<br>
<br>
-- <br>
Best regards,<br>
Leon<br>
<br>
"Creative work defines itself; therefore, confront the work."<br>
-- John Cage<br>
<br>
<br>
Leon Shernoff<br>
1511 E 54th St, Bsmt<br>
Chicago, IL 60615<br>
<br>
<a href="tel:%28312%29%20320-2190" target="_blank">(312) 320-2190</a><br>
<br>
_______________________________________________<br>
Chicago mailing list<br>
<a href="mailto:Chicago@python.org" target="_blank">Chicago@python.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.python.org_mailman_listinfo_chicago&d=CwMFaQ&c=gtIjdLs6LnStUpy9cTOW9w&r=VXIryE9UwJGlNMLzgMzDT4_t2NMrZf6alSphHwSEwC0&m=Qjv-ibCR2PwjZVVC67elJ22sHMjYfRHVTrWzsR7vVcE&s=hlMbGp4GVHN-hWXxV1_7A3BzZDW7GvxVHHVBC6-q3ZA&e=" target="_blank">https://mail.python.org/mailman/listinfo/chicago</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>