There are a myriad of different ways to secure requests to agent URLs. By default, all requests have three simple security features:
- the unique URL for each device is randomly generated during the BlinkUp process;
- the commands required to activate the agent are unknown to anyone but the developers; and
- all requests to https://agent.electricimp.com are SSL encrypted which prevents anyone from sniffing the contents of any request.
For many applications, this encryption plus obfuscation is sufficient security, especially if the requests to the agent are coming from a server or a controlled application. If further security/obfuscation is required we propose a few simple and common methods here. These methods also provide a bonus feature that, if the security is compromised at any point in the future, the parameters can be easily changed to reassert the security.