JWT is Awesome • Hacker News Board

Re: JWT is Awesome

#51

Post by chrisseaton » Tue, Feb 18, 2020, 2:35 PM UTC

twic wrote: post #40

teyc wrote: post #32

https://news.ycombinator.com/item?id=21785888 tptacek Credential attenuation in Macaroons is cryptographic; it's in how the tokens are constructed. I don't see the opportunity for a DoS (that didn't exist without attenuation already). Macaroons are a really lovely, tight, purpose-built design that happens to capture a lot of things you want out of an API token, including some things that JWTs don't express naturally…

I'd never heard of macaroons. Here is a website: http://macaroons.io/ I note that the logo depicts macarons [1], rather than macaroons [2]. A parent comment also mentions PASETO: https://paseto.io/ Sadly, a paseto does not appear to be any kind of biscuit. The PASETO site links to this searing indictment of JWTs and related things: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... I am far from qualifie…

Some locales do call the things in the icons macaroons.

Re: JWT is Awesome

#52

Post by stazz1 » Tue, Feb 18, 2020, 2:36 PM UTC

shkkmo wrote: post #24

tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

We use JWT for doing time and ip address limited cross domain redirection. We also use it for partners who want to provide sso access to our site with having to implement a full oAuth. They just provide us with their public key and use any of a number of libraries for to generate a JWT with the ip address and an short expiration and an email. Once we receive a JWT key and validate it using their public key (and other…

This sounds like the [only?] intelligent (and also unintendend?) use case for JWT

Re: JWT is Awesome

#53

Post by foray1010 » Tue, Feb 18, 2020, 2:36 PM UTC

tmikaeld wrote: post #35

nijave wrote: post #25

Earlier quoted context omitted.

That video is ridiculous. The whole time is spent talking about how cookies are superior to local storage which has little to do with JWT. You can use JWT and store it in a cookie. Session cookies are most certainly not automatically signed. Signing a session ID provides absolutely no value (signing claims, however, does). Revocation is exactly the same for both of them. JWT has a standard jti field for the session I…

If you cryptographically sign the session cookie, as suggested in the video, then you accomplish the exact same thing as a JWT token - so, then why use JWT at all, if you going to look up the session data from the database in any case. JWT was meant to be stateless, if it's not, then it's just a layer of unnecessary complexity with potential security and implementation flaws.

depends on if need to call other apis like microservices, you can use the JWT on behalf of the user to request the contents from other services. JWT also introduces `scope` which determine services user consented and allowed your backend to call. These things are not supported by a simple session cookie.

Re: JWT is Awesome

#54

Post by anonsivalley652 » Tue, Feb 18, 2020, 2:41 PM UTC

CiPHPerCoder wrote: post #48

Aeolun wrote: post #41

Earlier quoted context omitted.

As soon as AWS supports PASETO we can talk, until that time popularity equals value.

Give me a few months, then. :P If they agree it's a good idea, it should pick up quickly.

Don't count on it. As it happens, I used to be a AWS consultant w/ a third-party preferred vendor. Their product direction involves more politics, job security and creating a labyrinthian platform that's difficult to emulate precisely.

Re: JWT is Awesome

#55

Post by icebraining » Tue, Feb 18, 2020, 2:41 PM UTC

0x445442 wrote: post #45

The string 'JSON Web Token' doesn't appear anywhere on the web page. If you're going to use an acronym expand it out the first time you use it.

Like JSON? I think for some acronyms, JSON and JWT included, those are their "proper" names, with the expanded name being just a curious historical note.

Re: JWT is Awesome

#56

Post by anonsivalley652 » Tue, Feb 18, 2020, 2:45 PM UTC

Aeolun wrote: post #41

anonsivalley652 wrote: post #18

Earlier quoted context omitted.

Popularity != value. Get over false signals.

As soon as AWS supports PASETO we can talk, until that time popularity equals value.

No, I was speaking even more generally. There are thousands of mainframes still running COBOL that process trillions/billions of dollars of transactions per day. There are obscure software packages and programming languages you've never heard of doing many important, niche tasks. So no, popularity will never equal value. There is no wisdom in a mob. The. End.

Re: JWT is Awesome

#57

Post by Ficirdly » Tue, Feb 18, 2020, 2:45 PM UTC

teyc wrote: post #32

https://news.ycombinator.com/item?id=21785888 tptacek Credential attenuation in Macaroons is cryptographic; it's in how the tokens are constructed. I don't see the opportunity for a DoS (that didn't exist without attenuation already). Macaroons are a really lovely, tight, purpose-built design that happens to capture a lot of things you want out of an API token, including some things that JWTs don't express naturally…

Just not Macaroons again :(

Macaroons have many small edge cases that'll bite you when you try to use them in practice:

- there is no spec and all people re-implement the de-facto standard. If you read the whitepaper it's not what's in use.

- the de-facto implementation is full of holes, e.g. time is expressed without timezone so it's not clear if it's UTC or not.

- the implementation requires custom parser for custom binary format but the caveats in wild use (remember: there are no standard ones) still use text so it just avoids the potential benefits of encoding dates and numbers in binary.

- the highly hyped third-party macaroons are barely supported in implementations in the wild - only one level is allowed and it's not specified anywhere.

- if we're talking about third-party macaroons there is another layer of problems: no standard for caveats means your third-party service needs to be closely coupled with your own.

- immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma...

JWTs have many problems but compared to Macaroons it's just JSON and base64. This is available in all programming languages with no additional cost. JWTs also have actual spec that implementations can agree on. Macaroons promise you extreme power but doesn't deliver. Several of Macaroons issues could be resolved with some effort (e.g. standarization) others - like resolving cycles in third-party caveats are IMO design flaws deeply embedded in the format.

For more info from people deploying Macaroons in the wild see https://www.youtube.com/watch?v=MZFv62qz8RU

As for tptacek's recommendation this only serves as a reminder that even if a highly respected internet figure recommends you something you still need to do your own homework instead of blindly following.

Re: JWT is Awesome

#58

Post by idoubtit » Tue, Feb 18, 2020, 2:46 PM UTC

foray1010 wrote: post #53

tmikaeld wrote: post #35

Earlier quoted context omitted.

If you cryptographically sign the session cookie, as suggested in the video, then you accomplish the exact same thing as a JWT token - so, then why use JWT at all, if you going to look up the session data from the database in any case. JWT was meant to be stateless, if it's not, then it's just a layer of unnecessary complexity with potential security and implementation flaws.

depends on if need to call other apis like microservices, you can use the JWT on behalf of the user to request the contents from other services. JWT also introduces `scope` which determine services user consented and allowed your backend to call. These things are not supported by a simple session cookie.

That's precisely the use case for JWT I recently had to work with, where cookies are irrelevant.

The web server gets a token from the API server, then prepares a few JSON messages that the web client will send asynchronously with JS. Since each message content is signed, the web client can't tamper with what is sent to the API. JWT was perfect for this 3-tiers messaging.

Re: JWT is Awesome

#59

Post by [deleted] » Tue, Feb 18, 2020, 2:48 PM UTC

anonsivalley652 wrote: post #54

CiPHPerCoder wrote: post #48

Earlier quoted context omitted.

Give me a few months, then. :P If they agree it's a good idea, it should pick up quickly.

Don't count on it. As it happens, I used to be a AWS consultant w/ a third-party preferred vendor. Their product direction involves more politics, job security and creating a labyrinthian platform that's difficult to emulate precisely.

[deleted]

Re: JWT is Awesome

#60

Post by pier25 » Tue, Feb 18, 2020, 2:48 PM UTC

praveenweb wrote: post #19

JWTs have made client side auth integrations look better. But the problem is that common security considerations and implementation details are generally overlooked. 1. Tokens are typically stored in localStorage. (app becomes vulnerable to CSRF & XSS attacks). 2. Tokens can be stolen. Now this is generally controlled by having a very short expiration time. 3. Short expiration times mean persisting refresh tokens to…

> Yes! If a JWT is stolen, then the thief can can keep using the JWT.

Unless you have some form of fingerprinting the client who authenticated and received the JWT.