News for hackers. Stuff that matters.
Re:JSON Web Tokens should be avoided by tracker1 on Tuesday March 14, 2017 @01:32PM (#13869606)
Agreed... my first two experiences with JWT were creating my own implementation... in my case, the allowed public keys had to come via https from a specific server in the domain, even without PKI using shared key... I had hard coded the algorithm used for the signature. This could just as easily be filters on a library though, it's just my first experience didn't have a valid library, so I had to composite one (did use existing crypto library though).

JWT is a perfectly valid structure, even if the spec is more flexible than it should be. By that matter, https also has historically supported algorithms and protocols later broken. Nobody is suggesting we stop use HTTPS, only that we limit acceptable protocol and algorithms supported.

Re:JSON Web Tokens should be avoided by tptacek on Tuesday March 14, 2017 @02:03PM (#13869875)
No, almost everybody in the field laments SSL and TLS. It's probably too late at this point --- and has been for well over a decade --- to get to something better than TLS, and so TLS 1.3 is what we're stuck with. But that is demonstrably not the case with JWT. We don't have to convince all the browser vendor to upgrade out of JWT in lockstep. Avoiding another 20 years of hair-on-fire crypto vulnerabilities seems reason enough to lobby against that spec.
Re:JSON Web Tokens should be avoided by tracker1 on Tuesday March 14, 2017 @02:26PM (#13870114)
But any given algorithm today may not be sufficient tomorrow... so we just don't use ANY encryption? JWT is a perfectly valid structure.. there are options as to signing, so use/limit as needed.
Re:JSON Web Tokens should be avoided by yuhong on Wednesday March 15, 2017 @04:12AM (#13874569)
And I think JWT is more flawed than SSL/TLS.