You should not store sensitive data into jwt.
Spotting base64 encoded JSON, certificates, and private keys
131–135 of 135 posts
Re: Spotting base64 encoded JSON, certificates, and private keys
#132You can spot Base64 encoded JSON. The PEM format (that begins with `-----BEGIN [CERTIFICATE|CERTIFICATE REQUEST|PRIVATE KEY|X509 CRL|PUBLIC KEY]-----`) is already Base64 within the body.. the header and footer are ASCII, and shouldn't be encoded[0] (there's no link to the claim so perhaps there's another format similar to PEM?) You can't spot private keys, unless they start with a repeating text sequence (or use the…
> The PEM format (that begins with `-----BEGIN [CERTIFICATE|CERTIFICATE REQUEST|PRIVATE KEY|X509 CRL|PUBLIC KEY]-----`) is already Base64 within the body.. the header and footer are ASCII, and shouldn't be encoded[0] (there's no link to the claim so perhaps there's another format similar to PEM?) In practice, you will spot fully b64 encoded PEMs all the time once you have Kubernetes in play... create a Secret from a…
I don't always store my Kubernetes Secrets in files, but when I do, I prefer stringData.
Re: Spotting base64 encoded JSON, certificates, and private keys
#133Earlier quoted context omitted.
> The PEM format (that begins with `-----BEGIN [CERTIFICATE|CERTIFICATE REQUEST|PRIVATE KEY|X509 CRL|PUBLIC KEY]-----`) is already Base64 within the body.. the header and footer are ASCII, and shouldn't be encoded[0] (there's no link to the claim so perhaps there's another format similar to PEM?) In practice, you will spot fully b64 encoded PEMs all the time once you have Kubernetes in play... create a Secret from a…
I don't always store my Kubernetes Secrets in files, but when I do, I prefer stringData.
I believe OP meant $(kubectl get secret) which by default returns them in JSON and base64 encoded. I do agree with you that it would be stellar if kubectl were bright enough to recognize "there's no weird characters, show me in stringData" but there are already other way more important DX issues that haven't gotten any traction
Re: Spotting base64 encoded JSON, certificates, and private keys
#134Earlier quoted context omitted.
If you have a compression that works on encrypted data, you can avoid wasting your time on the "encryption".
Base64 isn't encryption. The overhead added follows an extremely predictable pattern. That said I've no idea what the performance of common compression algorithms might be in such a use case. The comment was entirely tongue in cheek.
I apologise for my mistake. Either the comment got edited or I misread encryption somewhere in there.
Re: Spotting base64 encoded JSON, certificates, and private keys
#135I've seen too many JWT tokens that it is very natural at this point