[SECURITY] Insecure Token Communication

[iwr-redmond]

The TOKEN_TM_URL defined in token_utils.rs is currently reached using insecure http instead of encrypted https. This means that identifiable user information including mobile phone number is transmitted in plain text and can be easily intercepted for purposes including identity theft.

Notably, any defense mechanisms that have been implemented are prone to circumvention when SSL is not implemented (Karlström, 2015, p23).

[metercai]

The request body of the API is encrypted ciphertext, so using either HTTP or HTTPS ensures security

[iwr-redmond]

Isn't the payload decrypted upstream to allow the DID to be authenticated? If so, the communication remains fundamentally insecure.

[metercai]

Isn't the payload decrypted upstream to allow the DID to be authenticated? If so, the communication remains fundamentally insecure.

DID is self validating and does not require upstream verification. Upstream provides additional third-party proof for traceability purposes.