Hacker News Reader

Sending an ssl/tls request also requires some entropy! It's needed to avoid MITM and replay attacks.

It doesn't need to be encrypted, just signed by the entropy source. The signature should be verifiable without entropy.

How does that prevent replay attacks?

Hmm good point. I guess you need entropy for a nonce.

Maybe include and sign a timestamp?

Sorta nice, but that wouldn't avoid replay issues.