Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is Awesome

thehftguy.com

Post reply on HN
Print view View original

71–80 of 170 posts

Re: JWT is Awesome

#71

Post by enumjorge »

cryptica wrote: post #42
CiPHPerCoder wrote: post #2

Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

That article doesn't contain a single logical argument. >> JSON Web Tokens are Often Misused So is everything else. Name one programming concept which isn't often misused. >> There were two ways to attack a standards-compliant JWS library to achieve trivial token forgery The keyword here is "were" - Just like how people in Europe "were" dying from the Bubonic plague - It doesn't mean that Europe is unsafe today. The…

Can you elaborate why session IDs inside cookies is dangerous?

Re: JWT is Awesome

#72

Post by Sharlin »

icebraining wrote: post #55
0x445442 wrote: post #45

The string 'JSON Web Token' doesn't appear anywhere on the web page. If you're going to use an acronym expand it out the first time you use it.

Like JSON? I think for some acronyms, JSON and JWT included, those are their "proper" names, with the expanded name being just a curious historical note.

I had never heard of JWT and I definitely know what JSON is. I don’t think they’re anywhere near each other in ubiquity.

Re: JWT is Awesome

#73

Post by skohan »

JWT always felt a bit strange to me. The fact that we pass user attributes back and fourth from the client feels more like evidence of flaws in the web as a platform than it seems like a real solution.

Re: JWT is Awesome

#74

Post by sk5t »

jmkni wrote: post #34
ben-schaaf wrote: post #16

Earlier quoted context omitted.

> If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes. I recon if the library you're using doesn't force you to pin the algorithm (or opt out of pinning), your foot is probably already full of bullet holes.

Noob question, what is pinning in the context of JWT?

Your question is a good one, and "pinning" is not a very appropriate term here. Whitelist acceptable algorithms by issuer, ok fine--you have to have a library of acceptable public keys or shared secrets to go along with each of the allowed algorithms anyway. The JWT consuming infrastructure here on top of jose4j uses a registry of keyinfo metadata to allow for provision of multiple expirable keys and supported algorithms for each authorized issuer, and I'm not sure why anyone would do it other than that way, really.

Disallowing the "none" algorithm is an important implementation detail, like, maybe your JWT library demands an environment value "JWT_ALLOW_UNSAFE_SIGNING_I_KNOW_WHAT_I_AM_DOING=1" or just doesn't support it in the first place. Maybe it was foolish to ever make any allowance for this in the first place.

Re: JWT is Awesome

#75

Post by saagarjha »

twic wrote: post #40
teyc wrote: post #32

https://news.ycombinator.com/item?id=21785888 tptacek Credential attenuation in Macaroons is cryptographic; it's in how the tokens are constructed. I don't see the opportunity for a DoS (that didn't exist without attenuation already). Macaroons are a really lovely, tight, purpose-built design that happens to capture a lot of things you want out of an API token, including some things that JWTs don't express naturally…

I'd never heard of macaroons. Here is a website: http://macaroons.io/ I note that the logo depicts macarons [1], rather than macaroons [2]. A parent comment also mentions PASETO: https://paseto.io/ Sadly, a paseto does not appear to be any kind of biscuit. The PASETO site links to this searing indictment of JWTs and related things: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... I am far from qualifie…

Off topic: it gives me undue vexation that there are two dessert items with names so similar to each other that everyone keeps confusing them. Can we just all agree to come up with a new name for one of them?

Re: JWT is Awesome

#76

Post by hombre_fatal »

icebraining wrote: post #55
0x445442 wrote: post #45

The string 'JSON Web Token' doesn't appear anywhere on the web page. If you're going to use an acronym expand it out the first time you use it.

Like JSON? I think for some acronyms, JSON and JWT included, those are their "proper" names, with the expanded name being just a curious historical note.

I'd say it's good writing to link to the wiki entry for a less common concept like JWT in the first paragraph, right next to where they first mention it. It's definitely not ubiquitous like JSON, SQL, or FBI.

Re: JWT is Awesome

#77

Post by bvrmn »

deathanatos wrote: post #31
blattimwind wrote: post #20

Earlier quoted context omitted.

> JWT as a storage format is great indeed. RSA or ECDSA with NIST curves for signing things doesn't strike me as "great".

If your complaint is that RSA is outdated and ECDSA is backdoored by the NSA, use Ed25519, which JWS/JWT supports[1]. [1]: https://tools.ietf.org/html/rfc8037#section-3.1

> JWS/JWT supports

Support for ed25519 signature in current implementations is pretty poor.

Re: JWT is Awesome

#79

Post by hujjji »

tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

I have implemented JWT with not much java code and only supporting one encryption standard.

It was easily implmeneted, easy to understand, secure by design and not open to any of those security issues because there was no magic lib which would have allowed for some downgrade attack.

And what did it actually solve? Session stickyness. Simple and easy.

Re: JWT is Awesome

#80

Post by Ficirdly »

oefrha wrote: post #68
Ficirdly wrote: post #57

Earlier quoted context omitted.

Just not Macaroons again :( Macaroons have many small edge cases that'll bite you when you try to use them in practice: - there is no spec and all people re-implement the de-facto standard. If you read the whitepaper it's not what's in use. - the de-facto implementation is full of holes, e.g. time is expressed without timezone so it's not clear if it's UTC or not. - the implementation requires custom parser for custo…

> - immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma... Wow. In case the master changes, here’s the highlighted code: /* XXX get some random bytes instead */ var enc_plaintext:Buffer = new Buffer(MacaroonsConstants.MACAROON_HASH_BYTES); enc_plaintext.fill(0); This library’s README should have an all cap “toy project, don’t use” up top.

> In case the master changes

That's unlikely (last commit in the project is dated Apr 22, 2017). And it's another problem with "the Macaroons ecosystem". After initial hype people discover real world issues with Macaroons and abandon their pet projects.

Post reply on HN