News for hackers. Stuff that matters.
Re:# of days since the last alg=none JWT vulnerability by chrisjarvis on Tuesday September 01, 2020 @06:22PM (#24347821)
> The other big mistake I've seen is encoding personal data in the token, instead of just an ID that only has meaning inside of your database. It turns out not everyone is aware that JWT tokens are publicly decodable and that the only security is in the signing + verification. Many people I've spoke with think the token is like a hash.

I have been working as a software engineer professionally for 3 years (the entire time with web technologies) and I learned this like 4 months ago... I think there needs to be more awareness of this.

Re:# of days since the last alg=none JWT vulnerability by mdaniel on Tuesday September 01, 2020 @06:42PM (#24347966)
Anytime one sees base64 text, have a little lookie at the decoded version, as there are usually all kinds of fascinating things that people will "encrypt" in b64
Re:# of days since the last alg=none JWT vulnerability by tialaramex on Tuesday September 01, 2020 @07:17PM (#24348238)
And you aren't the only one poking around in such weakly obfuscated data.

Part of the driving force behind the IETF's enthusiasm for end-to-end encryption is not high minded principles of privacy (though there certainly are plenty of people who care, not just from the EFF and ACLU) but engineers frustrated that protocols get ossified by idiots decoding packets and guessing what to allow rather than reading the documentation. If you encrypt everything, these idiots can't tell what is what and so they either block everything (which at least has the benefit of being obvious) or they give up and stop trying to do the impossible. Hooray.

The idiots also write passive aggressive "informational" documents about how the sky is falling because of all this encryption, but you get used to those.

Re:# of days since the last alg=none JWT vulnerability by kochthesecond on Tuesday September 01, 2020 @07:35PM (#24348377)
I am curious, did you never even have a look at the spec?
Re:# of days since the last alg=none JWT vulnerability by chrisjarvis on Wednesday September 02, 2020 @02:17PM (#24356083)
no, never did, not a bad idea when learning about a new technology haha