News for hackers. Stuff that matters.

A comment on Biscuit Authorization. Parent comment

Re:Biscuit Authorization by robertlagrant on Thursday December 14, 2023 @04:51AM (#38639608)
This is not a huge surface area. I don't know why this keeps coming up, but, while a silly default, is incredibly straightforward to not configure / remove / test for.
[ Parent | on HN ]
Re:Biscuit Authorization by grey-area on Saturday December 16, 2023 @02:45AM (#38662543)
JWTs are definitely a much larger surface area than simpler encrypted sessions storage and most people don’t need that.

I cited this as one example of that surface area that led to serious vulnerabilities. Most people don’t need multiple ways to encrypt their data, and certainly not a ‘no encryption’ option. Each added option adds more ways to mess things up.

[ Parent | on HN ]