Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

jvt.me

Post reply on HN
Print view View original

121–130 of 170 posts

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#121

Post by clinta »

jordache wrote: post #68
Liquid_Fire wrote: post #64

Earlier quoted context omitted.

On Firefox you can disable this via an about:config setting (set keyword.enabled to false).

ahh cool.. but a binary toggle is a bit to coarse. it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.

In your search settings you can add keywords. So if you set ? as the keyword for google you can type '? foobar' into the address bar to google for foobar.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#122

Post by clinta »

onion2k wrote: post #9
hatch_q wrote: post #6

But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?

No, it definitely isn't. Github (and probably others) will show you big scary warning messages if you commit things like AWS keys.

How does that work on the command line? Does it reject your push? Or is this only for people editing on the github website?

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#124

Post by wingi »

colinclerk wrote: post #20

http://jsonprettyprint.net/ ranks high for "json pretty print" in Google and is an example where data hits their server.

Server-side-rending is sure not privat.

More on http://jsonprettyprint.net/privacy - well formated.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#125

Post by hundchenkatze »

pinteresting wrote: post #46

If you could sandbox part of the screen to say this thing is standalone and cannot perform any networking abilities and is cut off from everything else on the page that would be great. The browser could recognise that tag and you get a safe space for people to copy/paste/interact with online web tools. I'm pretty sure you can do this with WASM right now, but the browser doesn't inform the user that this is a safe spa…

It's not exactly what you're describing and may be overkill, but you can definitely accomplish this with Qubes OS.

https://www.qubes-os.org/intro/

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#126

Post by jcims »

troebr wrote: post #107
jcims wrote: post #86

Earlier quoted context omitted.

I work at a place that takes this all very seriously. No. Google search is available but monitored, skype/gitlab/bitbucket/etc are all blocked. Code formatting tools are blocked to the extent possible and people are instructed not to use them. Folks that slip up and get caught are usually written up the first time, after that they are terminated. The only way to legitimately use tools like these from work are if they…

Do you work in a field that warrants this kind of stringent requirements or is the security team overzealous? Do these kind of rules extend to using third party libraries etc?

Both probably. Most of these rules have come as a result of regulatory action/audit findings. Efforts to dial these back repeatedly get stymied by people demonstrating the need for such checks.

Re: third party libraries, yes absolutely.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#127

Post by BiteCode_dev »

tomsmeding wrote: post #104
BiteCode_dev wrote: post #88

Earlier quoted context omitted.

And a good one too. I'm currently maintaining https://0bin.net , and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff. They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...). Don't trust random online services…

> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about it, or do you have other means of determining what kind of content gets posted? Just curious; I'm sure your encryption is on point.

People post the full links (including the key) everywhere, so regularly, we google a bit to check what people use us for.

This allowed us to discover we were pretty popular on the crypto community and in specific fan fic subreddits. Which lead us to implement btc tipping and reader mode.

We also got reports, tickets, dmca, etc.

We cannot brute force our thousands of paste encrypted payloads, but for a sample, it's easy to follow the bread crumbs. And if we do it, others do it too.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#128

Post by peterangular »

antihero wrote: post #57
paultopia wrote: post #41

For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.

I dunno, I worked at a bank that was about to be a Capital One direct competitor and I we weren't really worried about "leaking implementation details" via the structure of our tokens. Sounds like some security through obscurity.

Not leaking tokens/token structure !== security through obscurity.

I have seen idiotic implementations of JWT which effectively leak session details that should only be kept server-side because "it was just easy to validate it on the client-end of things"... this specific example is an extreme one from my career history, and was caught long before it ever made it to prod.

But.

In this engineer's "hello world"-level implementation of JWT they effectively overloaded the session with incredibly sensitive data that should have been server-side-only (later to back-pedal and say this was a "dev only" implementation!). They did use JWT.io to debug their "implementation", and having done that did leak non-trivial details to a third party about how our authentication system was built.

This guy was a "junior engineer" who was hired because of nepotism - making this an even more extreme case... but really it's not. I've worked with incredibly ignorant, careless, not trustworthy, desperate, etc. people through my entire career (admittedly being those things myself sometimes).

Anywho - not leaking implementation details, and potential software/infrastructure secrets is not security through obscurity.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#129

Post by kazinator »

If I made a list of the programs people should not be using online, some dinky data format validator would probably be among the last priorities on it, probably somewhere just above an online converter between l/100km and mpg, or an online egg timer. Pick your battles and all that.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#130

Post by R0b0t1 »

dathinab wrote: post #91
thieving_magpie wrote: post #44

Earlier quoted context omitted.

> they work at a bank---their threat model is probably rather more vigorous than most Until one day when you work with ACH files and start having existential dread about the american payroll system.

Yes it's sometimes rediculus with what regulated businesses can get away with as long as it's either historical or had been certified to be secure at some point in time.

The alternative is oftentimes doing nothing and putting people out of work. You shouldn't proactively punish people for the potential actions of other unrelated people who might choose to break the law.
Post reply on HN