71–80 of 170 posts
Better to establish good habits now.
I don't agree. I think online tools are great for quick-and-easy testing, and doesn't require any privacy issues. Mostly the benefit is ergonomics: I don't need to set up a bunch of stuff to do the thing I want, someone has done it because they had the exact same need. The kind of thing I typically do with them: - Diff two files - Check brackets. JSON, jwt, that kind of thing - Run code snippets in a fiddle site - Re…
I was boggling at how this could be tolerably efficient for someone, but I think I see it. My development workflow is terminal-centric, so copying out of the terminal to paste into a browser is extremely painful, whereas running 'diff', 'json_verify', etc. on local files or typing snippets into python/node/etc. from the shell is almost free. I suppose though if I were spending my day in VS Code or any kind of GUI IDE…
What if countries similarly tracked their dependencies on other countries and foreign companies, rather than just their budget? There are some trade-offs where you want to avoid dependency even if it is more costly. Recent scandals with constructs of selling water sources and public infrastructure to lease it back cheaper, comes to mind.
If you spend all your time in the browser anyway, it might be different for you.
For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
I think the author is over dramatic. Like when he says this: >I've been burned a number of times by folks putting a Non-Production JWT or an Open Banking Sandbox certificate into jwt.io. He hasn't been "burned" by that at all. No security breach occured because of that. He does have somewhat of a point, but he goes off into fantasy land trying to justify it.
> these are sensitive in of themselves, as they have implementation details for our services, and as mentioned, certain things could be used outside of Capital One. I imagine these JWTs will find their way into a frontend application in prod (because what else would they be for?), at which point any actual user of theirs could pull the token down and get access to these implementation details. The only thing sensitiv…
Witnessing developers copy-paste code from their editor into textareas on webpages to do formatting/linting/etc induces the same kind of internal cringe-factor as when witnessing general computer users use the mouse for absolutely everything and knowing zero keyboard shortcuts. Or to put it in contemporary terms: Trigger Warning: Unoptimized Workflows
It sounded like the OP had some solid proof but eventually it boils down to "I'm suspicious". It's a valid opinion just not an objective one
If there was proof it would be a different thread, but "don't paste credentials into websites you don't control" seems like great advice for life.