Re:JSON Web Tokens should be avoided
by tptacek on Tuesday March 14, 2017 @02:00PM
(#13869855)
I don't know how to respond to this in any other way than to say that it's unethical to build systems you know have security weaknesses.
[ Parent
| on HN ]
Re:JSON Web Tokens should be avoided
by davewritescode on Wednesday March 15, 2017 @09:00AM
(#13875748)
1 - You have not demonstrated in anyway that it's impossible to use JWT tokens in a secure manner. Just that it's easy to shoot yourself in the foot.
2 - It's not unethical to make tradeoffs, period. We all build systems that have potential attack vectors and we make tradeoffs based on threat models. That's the difference between Academics and Engineers.
Example: Hacker News allows shitty passwords, that's a security weakness. However, the data that's protected by that shitty password is pretty meaningless. Is that not a good security tradeoff? Is Hacker News unethical?