News for hackers. Stuff that matters.

A comment on Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful. Parent comment

Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by hinkley on Thursday April 16, 2020 @04:09PM (#22892985)
What system of application deployment and maintenance are you picturing where a new crypto algorithm shows up on a machine without an opportunity to make a one-line commit to your codebase?

And in a SaaS setting, what operational environment is going to want you to start using a new cryptographic algorithm with no formalism around the process? Someone is going to want to flip a proverbial switch.

[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by user5994461 on Thursday April 16, 2020 @05:51PM (#22893933)
Look no further than OpenSSL and Windows SSL.

These libraries doing the crypto, often managed by the OS, are upgrading the TLS protocol and ciphers on the fly with most applications having no awareness of what's going on.

[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by hinkley on Friday April 17, 2020 @01:01PM (#22900751)
I would argue the opposite. openSSL is such a can of worms at this point that if you suggested this sort of magic thinking in a design meeting, you'd have a fight on your hands and I wouldn't be the only person arguing with you.
[ Parent | on HN ]