Brute forcing JSON Web Tokens in C

Re:Brute forcing JSON Web Tokens in C by arnarbi on Saturday January 21, 2017 @08:47PM (#13453121)

"... with 32 bit keys."

The whole thing is editorialized to make it sound like the problem is with JWTs. It's not, this is just plain old improper use of perfectly good crypto.

Brute-forcing 32 bit HMAC keys isn't exactly newsworthy.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by brendanrius on Saturday January 21, 2017 @10:16PM (#13453407)

From the readme: "If you are very lucky or have a huge computing power"

Also the title "Brute forcing JWT in C" could not be clearer. This is not "0day found in JWT", or just "breaking JWT". This is brute force & nothing more

This is actually editorialized to make it sound the way it really is

[ Parent | on HN ]