trustly / bankapi Goto Github PK

bin/bankapi uses httplib.HTTPSConnection to establish connections using TLS.
However, the documentation for httplib.HTTPSConnection has the warning:
"Warning: This does not do any verification of the server’s certificate."

The client should either check the host's certificate, or refuse to use https.

As defined in RFC 6637, OpenPGP is capable of Elliptic Curve Cryptography. It would be nice to use ECC-Keys instead of RSA-Keys for the Public Key part because lower-bit ECC Keys offer the same strength as higher-bit RSA keys.

For example the weakest ECC-Keys over the NIST-256 curve has the same strength as a 3072bit RSA key but as all ECC Keys they require LESS computational power compared to RSA!

Please consider allowing ECC-Keys as an alternative for the RSA part!