Critical Vulnerabilities in JSON Web Token Libraries

Re:Critical Vulnerabilities in JSON Web Token Libraries by jessaustin on Wednesday April 01, 2015 @09:19AM (#9303268)

As the issues described in TFA make clear, the verifier really should know the algorithm in order to verify completely. However, since this format allows various algorithms, the algorithm must be recorded somewhere, especially in the public-key scenario when the verifier is probably not the signer.

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by Kiro on Wednesday April 01, 2015 @09:33AM (#9303365)

Thanks.

OT but what does TFA stand for? I've seen you use it in two threads and I presume it's referring to the posted article in question but I can't figure out the actual meaning.

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by williamcotton on Wednesday April 01, 2015 @09:50AM (#9303483)

The F*ing Article... probably evolved from RTFM. Hacker culture, so warm and welcoming, isn't it?

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by zaroth on Wednesday April 01, 2015 @10:11AM (#9303649)

That usage was deprecated by RFC19647. The correct definition is now 'The Featured Article'.

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by sp332 on Wednesday April 01, 2015 @10:09AM (#9303629)

The abbreviation gives some plausible deniability - it could be "the fine article"!

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by jessaustin on Wednesday April 01, 2015 @10:08AM (#9303623)

I've usually seen it as The Fine Article, but tastes vary. b^)

[ Parent | on HN ]