News for hackers. Stuff that matters.

A comment on Should I Use jwts For Authentication Tokens?. Parent comment

Re:Should I Use jwts For Authentication Tokens? by ramchip on Monday May 27, 2024 @08:22PM (#40496123)
> (or worse: using a shared-secret for signing tokens instead of asymmetric cryptography, ugh)

What’s so terrible about that? Several security engineers I trust favor designs with symmetric crypto, e.g. Fly.io https://fly.io/blog/macaroons-escalated-quickly/ and Facebook https://eprint.iacr.org/2018/413.pdf

[ Parent | on HN ]
Re:Should I Use jwts For Authentication Tokens? by ak217 on Monday May 27, 2024 @08:49PM (#40496289)
It limits your ability to compartmentalize your infrastructure, establish security perimeters, and provide defense-in-depth against vulnerabilities in your dependencies.
[ Parent | on HN ]