News for hackers. Stuff that matters.

A comment on Brute forcing JSON Web Tokens in C. Parent comment

Re:Brute forcing JSON Web Tokens in C by brendanrius on Saturday January 21, 2017 @04:49PM (#13452328)
That is definitely strange, if it is not sensitive data, would you mind sharing the JWT and the original secret? or try to find another example where it behaves like this?

Thanks

[ Parent | on HN ]
Re:Brute forcing JSON Web Tokens in C by jsd1982 on Saturday January 21, 2017 @06:04PM (#13452590)
It is sensitive data so I can't share the payload for a (possibly unfounded) fear of brute-forcing the correct key used. I can tell you that the key is not an ASCII string (it is a random sequence of bits). The jwt.io debugger verified the signature when I gave it the proper key and failed to verify with the key "e" that this tool reported.
[ Parent | on HN ]