Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

jvt.me

Post reply on HN
Print view View original

131–140 of 170 posts

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#131

Post by BiteCode_dev »

nybble41 wrote: post #117
tomsmeding wrote: post #104

Earlier quoted context omitted.

> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about it, or do you have other means of determining what kind of content gets posted? Just curious; I'm sure your encryption is on point.

The titles aren't encrypted. Perhaps people are putting personal data in the titles of their posts, or hinting at personal data in the encrypted portion? Which is still a problem since the code served by the site has access to the plaintext, even if it's not normally sent back to the server. It would be trivial to change the code to send the plaintext or encryption key to the server, or just weaken the encryption som…

Titles are rarely used, but I did receive emails of users saying "woops, can you delete this ?" with very personnal content.

Which is why we implemented the delete feature (creating a paste gives you a cookie that allows deletion) recently because we don't want to spend time on customer service for a free site.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#132

Post by GrantZvolsky »

dathinab wrote: post #89
paultopia wrote: post #41

For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.

It also is sadly not fantasy. Security is all about habits, using such tools make you train bad habits. Sure jwt.io should be fine, but what about the dependencies they use to build it how through are they checked. What about domain hijacking, https downgrade attacks and similar. Etc. It's probably still all fine for jwt.io they probably use certificate pinning and similar. If you want to know how tricky attacks can…

If you don't trust your team not to paste privileged production tokens to third party services, security training might be a better course of action than defining vague rules.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#133

Post by recursive »

gruez wrote: post #113
tester34 wrote: post #28

Earlier quoted context omitted.

>For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information. As long as it's prod env and your expiration time is somewhat reasonable, then I don't think it is sensitive at all unless you're storing an actual sensitive informations in them.

So you're just hoping that there isn't a bad guy on the other side trying to use the credentials in real time? Seems like a bad assumption to make, especially for a site that's specifically made for pasting in JWTs.

No. No one's hoping anything. It's more like a realization that even if there's a bad guy, they're only going to be able to pwn your dev environment, which has no valuable data in it, and can be replaced with a script.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#134

Post by BiteCode_dev »

agumonkey wrote: post #111
BiteCode_dev wrote: post #99

Earlier quoted context omitted.

We have about 20k hits a day. Or do you talk about dmca ?

normal users unless you're up to talk about dmca requests too :)

Dmca + pedo + dox reports are about a dozen a year. Pastes are a niche.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#135

Post by andinus »

reificator wrote: post #53
londons_explore wrote: post #47

Earlier quoted context omitted.

As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/". If you prefix with " http://" , no requests are made to Google (except "h", "ht", "htt", "http", and "http:")

> If you prefix with " http://" , no requests are made to Google (except "h", "ht", "htt", "http", and "http:") This seems surprising to me. Can you back up this claim?

If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason.

- https://support.mozilla.org/en-US/kb/search-suggestions-fire...

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#136

Post by andinus »

vimslayer wrote: post #55
jordache wrote: post #17

Earlier quoted context omitted.

i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search

I often have the opposite problem: I'm on Firefox and try to google "FooError: Bar happened" and instead of directing to google, Firefox prompts me to select an application to open "fooerror links".

You can enable the search bar, Ctrl-k focuses on it.

- https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#137

Post by hirako2000 »

recov wrote: post #82

I've made internal tools for the exact thing, jwt inspection , which was a nice exercise and guarantees privacy. For things like JSON, using your editor/cli would be much faster. I'm not sure why a lot of developers don't add these integrations/learn the tools.

Because many users would rather not learn how to use 12 different cli commands. Many software dev can't even be bothered to learn how to copy/paste text content in the terminal or vim that spans longer than the screen.

A Web page makes things simpler, everyone has a browser. I built an internal web tool, replicated what the ones found on the Internet do, and developers in my organisation are using it daily.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#138

Post by zzapplezz »

seaerkin wrote: post #32

I agree with the author. Is it highly unlikely, sure, but it's important to create awareness of the risks associated. At the end of the day, you are sending potentially sensitive data to a third party. Good security posture is all about building habits and I personally don't want myself or my team being comfortable with the idea of pasting code or JSON config files into a third party system. If any of these online to…

This topic is much broader than just online JSON tools. There are all kinds of converters, transformers, and linting tools available online for many languages and frameworks that you shouldn't be sending your private code to.

I disagree with the author on always running it locally for yourself. If a service is useful enough, you should set it up internally so your team has a sandbox to use it. Spread the knowledge instead of hoarding it. Compiler Explorer is an example here.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#139

Post by jordache »

gruez wrote: post #112
jordache wrote: post #68

Earlier quoted context omitted.

ahh cool.. but a binary toggle is a bit to coarse. it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.

Or just have two text inputs[1]: one for url and one for search, rather than trying to overload two functions into one text input and trying to guess what the user wants. [1] https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...

oooo didn't know that setting was available!

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#140

Post by reificator »

andinus wrote: post #135
reificator wrote: post #53

Earlier quoted context omitted.

> If you prefix with " http://" , no requests are made to Google (except "h", "ht", "htt", "http", and "http:") This seems surprising to me. Can you back up this claim?

If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason. - https://support.mozilla.org/en-US/kb/search-suggestions-fire...

No I get that part.

I guess I just had a different interpretation of "no requests are made to Google". It seems "no requests" was intended to be "no search suggestion requests" and not "no requests that leak this information to google".

Post reply on HN