News for hackers. Stuff that matters.
Re:Ask HN: What's the recommended method of adding authentic... by e12e on Tuesday January 16, 2018 @07:10PM (#16164192)
You can rotate the secret to invalidate all tokens.
Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Wednesday January 17, 2018 @11:15AM (#16169065)
No, you can't. That breaks all of your users, and so you'll rarely do it, even when it might be warranted. Don't engineer security countermeasures that you (a) might need to rely on and (b) will be afraid to use.
Re:Ask HN: What's the recommended method of adding authentic... by e12e on Wednesday January 17, 2018 @06:01PM (#16172903)
Good points. But for some types of apps, you might have groups of users (a company, team, municipality) that you might be able to afford the cost of "everyone log in again". Or you might be able to safely log out everyone after business hours (if in the same timezone).