Re:Hardcoded secrets, unverified tokens, and other common JW...
by tialaramex on Saturday June 27, 2020 @02:42PM
(#23663729)
For (almost?) all security components the worst and most prevalent mistake is going to be "That was not the correct component to solve your problem".
Here's a nice real world example:
* Expensive combination padlock on a cheap shared property. The building owners decided our bin shed should be locked, they bought a nice padlock, installed the lock and mailed out the code, residents don't need the hassle so somebody doesn't close the padlock, thieves who would never want to steal our garbage do want a free padlock... no more padlock.
You give unnecessary JWTs as an example, but here's another way too many people choose the wrong component:
* Public key cryptography is pointless unless your private keys are private. If your system involves centrally minting key pairs and then sending them out to people you don't actually have a public key cryptography system, you've got a secret key cryptography system in which you are (at best) wasting a lot of resources and getting no benefit. Way too many corporate VPNs are like this. Most S/MIME and almost every private SSL CA I've seen is the same.
Here's a nice real world example:
* Expensive combination padlock on a cheap shared property. The building owners decided our bin shed should be locked, they bought a nice padlock, installed the lock and mailed out the code, residents don't need the hassle so somebody doesn't close the padlock, thieves who would never want to steal our garbage do want a free padlock... no more padlock.
You give unnecessary JWTs as an example, but here's another way too many people choose the wrong component:
* Public key cryptography is pointless unless your private keys are private. If your system involves centrally minting key pairs and then sending them out to people you don't actually have a public key cryptography system, you've got a secret key cryptography system in which you are (at best) wasting a lot of resources and getting no benefit. Way too many corporate VPNs are like this. Most S/MIME and almost every private SSL CA I've seen is the same.