I am constantly suspicious of all online tools. Every time I see someone paste a blob of customer data into an open browser tab to format the JSON I cringe; this is precisely the reason I spent a few hours to learn how to use `jq` efficiently.
Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
81–90 of 170 posts
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#82I've made internal tools for the exact thing, jwt inspection , which was a nice exercise and guarantees privacy. For things like JSON, using your editor/cli would be much faster. I'm not sure why a lot of developers don't add these integrations/learn the tools.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#83Earlier quoted context omitted.
> these are sensitive in of themselves, as they have implementation details for our services, and as mentioned, certain things could be used outside of Capital One. I imagine these JWTs will find their way into a frontend application in prod (because what else would they be for?), at which point any actual user of theirs could pull the token down and get access to these implementation details. The only thing sensitiv…
There are server side JWTs that are never exposed to the users.
I thought the entire point of signing a JWT was because you need to validate it because there is some endpoint that is untrusted and you have to treat the claims as potentially compromised.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#84Earlier quoted context omitted.
> these are sensitive in of themselves, as they have implementation details for our services, and as mentioned, certain things could be used outside of Capital One. I imagine these JWTs will find their way into a frontend application in prod (because what else would they be for?), at which point any actual user of theirs could pull the token down and get access to these implementation details. The only thing sensitiv…
It is rather common practice to encrypt the JWT that is presented to the browser which uses it as an opaque value. Pasting a decrypted token on a public site is then definitely a form of information disclosure. Whether it is exploitable or not is a different question.
I did not know that. What would be the point of encrypting the JWT? Allowing the client to see the claim should not really be a concern.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#85While this article goes into the technical detail of how an attack from jwt.io to a developer might work, I think it most importantly leaves out what the potential threat actor in this threat model is, and what they hope to achieve. The actor would need to compromise jwt.io and use it to specifically target some developer (since the data is likely in localStorage).
This kind of attack is, I think very unlikely to happen because the costs vs potential rewards / risk are so poorly balanced. A jwt.io compromise is pretty hard, and you might get nothing from it!
That said, I agree with the idea that within the web security model, people should not be pasting security-critical data into sites! But I think this is more an issue of people having access to these security-critical keys than the sites themselves. After all, they could have downloaded a malicious binary, or their laptop could be stolen. People should not be put in a position where they have security critical keys on their clipboard.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#86But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
I work at a place that takes this all very seriously. No. Google search is available but monitored, skype/gitlab/bitbucket/etc are all blocked. Code formatting tools are blocked to the extent possible and people are instructed not to use them. Folks that slip up and get caught are usually written up the first time, after that they are terminated.
The only way to legitimately use tools like these from work are if they pass rigorous vendor assessment processes and rock solid contracts in place covered by nine figure E&O policies.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#87For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
worked at a courtroom, most pastebin clones were banned it's a natural worry
It’s damn near impossible to even get the government to setup a locked down file sharing folder for an active lawsuit using a platform like Box or OpenText that they already have in place unless someone relatively high up is committed to pushing it through IT. The justice system does not mess around. If you try to send, say, a casual Dropbox link to a DOJ employee, they typically aren’t allowed to even click on it.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#88For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
worked at a courtroom, most pastebin clones were banned it's a natural worry
And a good one too. I'm currently maintaining https://0bin.net, and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff.
They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...).
Don't trust random online services with your data. FOSS or not, the code we serve can only be trusted as far as you and I we can be. And you don't know us. And you will make mistakes.
Now I'm guilty of it too, I share passwords with 0bin sometimes. But at least it's my service, I can assess the level of threat.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#89For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
It also is sadly not fantasy.
Security is all about habits, using such tools make you train bad habits.
Sure jwt.io should be fine, but what about the dependencies they use to build it how through are they checked. What about domain hijacking, https downgrade attacks and similar. Etc.
It's probably still all fine for jwt.io they probably use certificate pinning and similar.
If you want to know how tricky attacks can become just look into the etherum dark forest article. Which had been posted here a few days ago.
It's not a question if such attacks (based on undermining widely used web tools) happen it's just about when and how big the fallout will be.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#90Earlier quoted context omitted.
worked at a courtroom, most pastebin clones were banned it's a natural worry
It’s damn near impossible to even get the government to setup a locked down file sharing folder for an active lawsuit using a platform like Box or OpenText that they already have in place unless someone relatively high up is committed to pushing it through IT. The justice system does not mess around. If you try to send, say, a casual Dropbox link to a DOJ employee, they typically aren’t allowed to even click on it.
I came there believing "who cares" really but anytime there's money involved you step into the piranha bay. I heard even lawyers had to be followed around in the archive rooms.. some would snatch documents, or sniff whatever info they could to help their case.
So yeah they have to be careful because people are trying to tip them over regularly.
That said I naively plugged my phone on day 2 and their setup gladly accepted my device as a mtp mount (even loaded some drivers on the way).
I had access to stuff I shouldn't..
you get a weird feeling of paranoia yet nothing that solid. It's a big mass with official titles of people trying to be serious.