News for hackers. Stuff that matters.

A comment on Critical Vulnerabilities in JSON Web Token Libraries. Parent comment

Re:Critical Vulnerabilities in JSON Web Token Libraries by nosir33 on Wednesday April 01, 2015 @01:08PM (#9305120)
Can you expand? JWT are a good way to remove state from the service and the HMAC lets you trust it. This looks like an implementation bug, which is unfortunate, but not a reason to avoid the technology.
[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by tptacek on Wednesday April 01, 2015 @01:13PM (#9305151)
I wrote 10 warning signs of bad crypto standards on Twitter a few minutes ago, largely inspired by JWT.
[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by jessaustin on Wednesday April 01, 2015 @02:42PM (#9305837)
All points well taken. Still, people need to pack stuff into cookies. There are probably some modules for some environments that do this in unimpeachable fashion. How likely is the average developer to reliably pick those modules, or (haha) just code up the equivalent without using a module? At least a flawed consensus around JWT gets people looking at it.

So now what? The draft [0] hasn't expired yet, so it's possible they'll just rip out the public-key stuff. What should they add to answer your reservations about CTR+HMAC?

[0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by jessaustin on Wednesday April 01, 2015 @04:52PM (#9306788)
Apparently the drafts have been sent to the editor so they can't be changed. [1] Oh well!

[1] http://self-issued.info/?p=1323

[ Parent | on HN ]