Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

jvt.me

Post reply on HN
Print view View original

141–150 of 170 posts

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#141

Post by Legogris »

BiteCode_dev wrote: post #88
agumonkey wrote: post #66

Earlier quoted context omitted.

worked at a courtroom, most pastebin clones were banned it's a natural worry

And a good one too. I'm currently maintaining https://0bin.net , and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff. They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...). Don't trust random online services…

I just stumbled on this the other day.

https://github.com/eranchetz/sup3rS3cretMes5age

Super easy to set up with Vault, it just hooks into the cubbyhole engine. The one-time-token is also the decryption key for the data store. I find it great for myself and the occasional email but also wouldn't really want to have others use it too much.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#142

Post by wardnath »

beardedwizard wrote: post #56
wardnath wrote: post #11

Earlier quoted context omitted.

Agreed. This pretty much applies with any data & tool. If the data is extra sensitive, make extra sure the tool you are using is secure. If your data is for dev purposes only, the tool doesn't have to be validated as thoroughly.

Wow really? Lateral movement is very real, your mindset is dangerous.

That is a good point to make. If the development data can lead to exfiltration of higher privacy data then I would define it as "more sensitive" and take that into consideration, this particularly applies to config information required for authentication. I understand your perspective however, it is important to take lateral movement into account.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#144

Post by BiteCode_dev »

Legogris wrote: post #141
BiteCode_dev wrote: post #88

Earlier quoted context omitted.

And a good one too. I'm currently maintaining https://0bin.net , and because we encrypt everything client side, people feel like they can post anything they want. We get some pretty personnal stuff. They really should not. It's a can of worms. We can get compromised. Bought. Receive a court order (we comply with dmca). Or they could be on the wrong URL (typo squatting, phishing...). Don't trust random online services…

I just stumbled on this the other day. https://github.com/eranchetz/sup3rS3cretMes5age Super easy to set up with Vault, it just hooks into the cubbyhole engine. The one-time-token is also the decryption key for the data store. I find it great for myself and the occasional email but also wouldn't really want to have others use it too much.

That's the beauty of FOSS. 0bin is itself a python rewrite of the PHP zerobin, the later was also forked into privatebin.

Now a zero knowledge pastebin is kind of a category, thanks to the french blogger sebsauvage that started the trend.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#145

Post by MaxBarraclough »

andinus wrote: post #135
reificator wrote: post #53

Earlier quoted context omitted.

> If you prefix with " http://" , no requests are made to Google (except "h", "ht", "htt", "http", and "http:") This seems surprising to me. Can you back up this claim?

If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason. - https://support.mozilla.org/en-US/kb/search-suggestions-fire...

> If you have search suggestions enabled then "http:" will be sent

What's the point of sending those characters?

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#146

Post by evanreichard »

seaerkin wrote: post #32

I agree with the author. Is it highly unlikely, sure, but it's important to create awareness of the risks associated. At the end of the day, you are sending potentially sensitive data to a third party. Good security posture is all about building habits and I personally don't want myself or my team being comfortable with the idea of pasting code or JSON config files into a third party system. If any of these online to…

I keep a copy of CyberChef [0] locally. Can do the majority of the data manipulation I need. Does JWT Decoding / Signing / Verification and JSON Validation / Pretty as well. You can experiment with insignificant data here [1].

[0] https://github.com/gchq/CyberChef

[1] https://gchq.github.io/CyberChef/

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#147

Post by darth_avocado »

I mean, as a dev for last 15 years, my rule of thumb is "don't trust the internet". Don't copy paste your code onto the internet, and don't copy paste internet's code into yours.

Also, another rule that helps, what's in production, stays in production. Don't copy paste things onto your machine, don't write things down in your notebook and don't even try sending it over the public internet.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#149

Post by antsar »

MaxBarraclough wrote: post #145
andinus wrote: post #135

Earlier quoted context omitted.

If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason. - https://support.mozilla.org/en-US/kb/search-suggestions-fire...

> If you have search suggestions enabled then "http:" will be sent What's the point of sending those characters?

Search Suggestions. You typed "h", maybe you want to search for "harpoons". "ht" might suggest "htaccess". "http" might be a search for "httpie". etc.

Re: Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators

#150

Post by MaxBarraclough »

antsar wrote: post #149
MaxBarraclough wrote: post #145

Earlier quoted context omitted.

> If you have search suggestions enabled then "http:" will be sent What's the point of sending those characters?

Search Suggestions. You typed "h", maybe you want to search for "harpoons". "ht" might suggest "htaccess". "http" might be a search for "httpie". etc.

Yes, of course :-P
Post reply on HN