Earlier quoted context omitted.
how large the amount of daily requests on your service ? just curious
We have about 20k hits a day. Or do you talk about dmca ?
normal users unless you're up to talk about dmca requests too :)
Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
111–120 of 170 posts
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#112Earlier quoted context omitted.
On Firefox you can disable this via an about:config setting (set keyword.enabled to false).
ahh cool.. but a binary toggle is a bit to coarse. it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.
Or just have two text inputs[1]: one for url and one for search, rather than trying to overload two functions into one text input and trying to guess what the user wants.
[1] https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#113For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information. I don't discourage online tooling in general. It's a risk/benefit trade-off---No, you shouldn't paste sensitive information into websites run by other people in general, but for non-sensive information where you don't care if the online tool is logging it or not, go for it. There are…
>For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information. As long as it's prod env and your expiration time is somewhat reasonable, then I don't think it is sensitive at all unless you're storing an actual sensitive informations in them.
So you're just hoping that there isn't a bad guy on the other side trying to use the credentials in real time? Seems like a bad assumption to make, especially for a site that's specifically made for pasting in JWTs.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#114Earlier quoted context omitted.
And a good one too. I'm currently maintaining https://0bin.net , and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff. They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...). Don't trust random online services…
> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about it, or do you have other means of determining what kind of content gets posted? Just curious; I'm sure your encryption is on point.
From what I can see on the FAQ:
>The goal of 0bin is not to protect the user and their data (including, obviously, their secrets).
>Instead, it aims to protect the host from being sued for the content users pasted on the pastebin. The idea is that you cannot require somebody to moderate something they cannot read - as such, the host is granted plausible deniability.
Honestly, the forwardness is refreshing.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#115Some people at certain lines of work must use computers that cannot connect to the internet at all. This should not be a surprise to anyone.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#116Even if JWT.io does everything on the up and up, if that site is compromised then every single user that pastes their token is as well. If I was a malicious actor, that's a site I would target first. We should use trusted local utilities to decode these tokens.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#117Earlier quoted context omitted.
And a good one too. I'm currently maintaining https://0bin.net , and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff. They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...). Don't trust random online services…
> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about it, or do you have other means of determining what kind of content gets posted? Just curious; I'm sure your encryption is on point.
The titles aren't encrypted. Perhaps people are putting personal data in the titles of their posts, or hinting at personal data in the encrypted portion? Which is still a problem since the code served by the site has access to the plaintext, even if it's not normally sent back to the server. It would be trivial to change the code to send the plaintext or encryption key to the server, or just weaken the encryption somehow. Even if you trust the site operators they could be ordered to implement a change like that with an NSL, and prohibited from talking about it.
As they say in the FAQ, the encryption is there to provide plausible deniability for the operator of the site, not to protect the users' data.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#118It sounded like the OP had some solid proof but eventually it boils down to "I'm suspicious". It's a valid opinion just not an objective one
Not everything can be proven until it's too late; at some point experience and informed intuition need to be part of the risk evaluation.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#119But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
(firstly you should set a different default search engine)
It's been nice to use the Firefox setting to have a separate search bar. Your address bar will show more results from your history, which is often what I actually need. Then you can just hit the down arrow to select "Search with x" options.
My only minor quip is that your default search engine will be last in the list.
Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
#120I agree with the author. Is it highly unlikely, sure, but it's important to create awareness of the risks associated. At the end of the day, you are sending potentially sensitive data to a third party. Good security posture is all about building habits and I personally don't want myself or my team being comfortable with the idea of pasting code or JSON config files into a third party system. If any of these online to…
* Is it highly unlikely, sure, but it's important to create awareness of the risks associated. At the end of the day, you are sending potentially sensitive data to a third party.* I don't think it is highly unlikely. I think it is highly likely that if you make a habit of using these tools one of them will eventually be compromised. Either through a technical hack, financial pressure, purchase by an immoral entity, o…
The likelihood of compromise depends on data being sent + chance of said service being malicious, which is why I said highly unlikely. Even if I gave you a JWT or config file, you'd still have to know how and where to use it. Sometimes this can be obvious, sometimes even if you know how, you can't access the where like if the credentials contained access to a db local to only my machine or to a server behind a firewall.