Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is Awesome

thehftguy.com

Post reply on HN
Print view View original

31–40 of 170 posts

Re: JWT is Awesome

#31

Post by deathanatos »

blattimwind wrote: post #20
fuzzy2 wrote: post #13

I’m always amused that with JWT, there never appears to be any separation between JWT-the-storage-format and JWT-what-I-do-with-it. JWT as a storage format is great indeed. If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. Everything else isn’t JWT. Sure you can use it with OpenID/OAuth/whatever. Sure you can store them in cookies. Sure you can use them with or w…

> JWT as a storage format is great indeed. RSA or ECDSA with NIST curves for signing things doesn't strike me as "great".

If your complaint is that RSA is outdated and ECDSA is backdoored by the NSA, use Ed25519, which JWS/JWT supports[1].

[1]: https://tools.ietf.org/html/rfc8037#section-3.1

Re: JWT is Awesome

#32

Post by teyc »

https://news.ycombinator.com/item?id=21785888

  tptacek
  Credential attenuation in Macaroons is 
  cryptographic; it's in how the tokens
  are constructed. I don't see the opportunity
  for a DoS (that didn't exist without 
  attenuation already).
  
  Macaroons are a really lovely, tight, 
  purpose-built design that happens to 
  capture a lot of things you want out of 
  an API token, including some things that
  JWTs don't express naturally despite 
  their kitchen-sink design.

  JWT is more popular because there are 
  libraries for it in every language, and
  people don't think of tokens as a cryptographic
  design (or nobody would be using JWT!), they
  think of them as a library ecosystem. JWT
  is definitely the stronger library ecosystem!
 
  This is also why I probably wouldn't ever
  bother recommending PASETO. If you're sophisticated
  enough to evaluate token formats based on their
  intrinsic design, then you should implement
  Macaroons if possible (it's almost always possible).
  If you're not, then you're going to use JWT.

Re: JWT is Awesome

#33

Post by aPoCoMiLogin »

praveenweb wrote: post #19

JWTs have made client side auth integrations look better. But the problem is that common security considerations and implementation details are generally overlooked. 1. Tokens are typically stored in localStorage. (app becomes vulnerable to CSRF & XSS attacks). 2. Tokens can be stolen. Now this is generally controlled by having a very short expiration time. 3. Short expiration times mean persisting refresh tokens to…

> With multiple tabs open, logging out on one tab needs to be synced with rest of the tabs via some event listeners.

that's a problem with every site in general, which doesn't use any kind of event listeners.

Re: JWT is Awesome

#34

Post by jmkni »

ben-schaaf wrote: post #16
fuzzy2 wrote: post #13

I’m always amused that with JWT, there never appears to be any separation between JWT-the-storage-format and JWT-what-I-do-with-it. JWT as a storage format is great indeed. If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. Everything else isn’t JWT. Sure you can use it with OpenID/OAuth/whatever. Sure you can store them in cookies. Sure you can use them with or w…

> If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. I recon if the library you're using doesn't force you to pin the algorithm (or opt out of pinning), your foot is probably already full of bullet holes.

Noob question, what is pinning in the context of JWT?

Re: JWT is Awesome

#35

Post by tmikaeld »

nijave wrote: post #25
tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

That video is ridiculous. The whole time is spent talking about how cookies are superior to local storage which has little to do with JWT. You can use JWT and store it in a cookie. Session cookies are most certainly not automatically signed. Signing a session ID provides absolutely no value (signing claims, however, does). Revocation is exactly the same for both of them. JWT has a standard jti field for the session I…

If you cryptographically sign the session cookie, as suggested in the video, then you accomplish the exact same thing as a JWT token - so, then why use JWT at all, if you going to look up the session data from the database in any case.

JWT was meant to be stateless, if it's not, then it's just a layer of unnecessary complexity with potential security and implementation flaws.

Re: JWT is Awesome

#36

Post by fuzzy2 »

jmkni wrote: post #34
ben-schaaf wrote: post #16

Earlier quoted context omitted.

> If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. I recon if the library you're using doesn't force you to pin the algorithm (or opt out of pinning), your foot is probably already full of bullet holes.

Noob question, what is pinning in the context of JWT?

It means to allow only expected algorithms.

Because as critics rightfully point out, without any whitelisting, you can just specify that your JWT does not have a signature and then it’s a valid token, whatever the contents.

Re: JWT is Awesome

#37

Post by tmikaeld »

snak wrote: post #12
tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

Well, for a long time there was no SameSite browser support for cookies, CSRF was a vulnerability (excluding STP and other techniques to avoid it).

You're right, SameSite became properly supported just a year ago for the majority of browsers.

Reference:

https://caniuse.com/#search=SameSite

Re: JWT is Awesome

#38

Post by twic »

tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

JWT is just a particular format for cookies.

Re: JWT is Awesome

#39

Post by andreareina »

jmkni wrote: post #34
ben-schaaf wrote: post #16

Earlier quoted context omitted.

> If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. I recon if the library you're using doesn't force you to pin the algorithm (or opt out of pinning), your foot is probably already full of bullet holes.

Noob question, what is pinning in the context of JWT?

JWT allows for the tokens to be signed using any of several algorithms, including none[1]. Pinning would restrict this to preferably just one, but at the very least should not allow unauthenticated tokens.

[1] https://tools.ietf.org/html/rfc7518#section-3

Re: JWT is Awesome

#40

Post by twic »

teyc wrote: post #32

https://news.ycombinator.com/item?id=21785888 tptacek Credential attenuation in Macaroons is cryptographic; it's in how the tokens are constructed. I don't see the opportunity for a DoS (that didn't exist without attenuation already). Macaroons are a really lovely, tight, purpose-built design that happens to capture a lot of things you want out of an API token, including some things that JWTs don't express naturally…

I'd never heard of macaroons. Here is a website:

http://macaroons.io/

I note that the logo depicts macarons [1], rather than macaroons [2].

A parent comment also mentions PASETO:

https://paseto.io/

Sadly, a paseto does not appear to be any kind of biscuit.

The PASETO site links to this searing indictment of JWTs and related things:

https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

I am far from qualified to evaluate any of these!

[1] https://en.wikipedia.org/wiki/Macaron

[2] https://en.wikipedia.org/wiki/Macaroon

Post reply on HN