News for hackers. Stuff that matters.
Re:Why to not use JWT (2021) by xorcist on Thursday September 29, 2022 @10:54AM (#33021576)
You do need a cryptographically secure RNG to work with JWTs though. There's no getting around the need for randomness.
Re:Why to not use JWT (2021) by diroussel on Friday September 30, 2022 @05:17PM (#33040921)
You only need a cryptographically secure RNG to generate a key pair. Assuming asymetric keys. That private key can then be used to sign many many JWTS.

Whereas generating new session ids will always need fresh entropy.

Re:Why to not use JWT (2021) by dontlaugh on Monday October 03, 2022 @05:55AM (#33065376)
That depends on the algorithm, some depend on randomness like IVs.
Re:Why to not use JWT (2021) by diroussel on Monday October 03, 2022 @06:35AM (#33065661)
Maybe you are thinking of JWE?

If the signing of the JWT wasn’t deterministic, then it would be hard to verify.

Re:Why to not use JWT (2021) by dontlaugh on Tuesday October 04, 2022 @05:11AM (#33078016)
Correct. Some auth systems use JWE. Some even use it interchangeably with just JWS.