Re:# of days since the last alg=none JWT vulnerability
by mdaniel on Tuesday September 01, 2020 @06:42PM
(#24347966)
Anytime one sees base64 text, have a little lookie at the decoded version, as there are usually all kinds of fascinating things that people will "encrypt" in b64
[ Parent
| on HN ]
Re:# of days since the last alg=none JWT vulnerability
by tialaramex on Tuesday September 01, 2020 @07:17PM
(#24348238)
And you aren't the only one poking around in such weakly obfuscated data.
Part of the driving force behind the IETF's enthusiasm for end-to-end encryption is not high minded principles of privacy (though there certainly are plenty of people who care, not just from the EFF and ACLU) but engineers frustrated that protocols get ossified by idiots decoding packets and guessing what to allow rather than reading the documentation. If you encrypt everything, these idiots can't tell what is what and so they either block everything (which at least has the benefit of being obvious) or they give up and stop trying to do the impossible. Hooray.
The idiots also write passive aggressive "informational" documents about how the sky is falling because of all this encryption, but you get used to those.