5 ms·
So, as suggested above, come up with a standard that encodes that subset – "Iron-JWT" or what have you. Much easier for adoption to use a "better version" of t
by rattray 10y ago
So, as suggested above, come up with a standard that encodes that subset – "Iron-JWT" or what have you.
Much easier for adoption to use a "better version" of the widely-used tool you're already using than some newfangled thing that a guy on HN said was more secure.
- CiPHPerCoder 10y agoI've previously made my proposal to the JOSE IETF mailing list. The participants just held their nose up to it. https://www.ietf.org/mail-archive/web/jose/current/msg05621.html https://www.ietf.org/mail-archive/web/jose/current/msg05621.... https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03 https://gist.github.com/paragonie-scott/c88290347c2589b0cd38... When I'm not dealing with client work, I'll write a replacement for JOSE that has the properties I outlined above. Until I find the free time for this, things that increase my income take precedence.
- yuhong 10y agoNotice that they did not include JWT in this!
- CiPHPerCoder 10y agoJWT uses JWS, JWE, or both. Any criticism that targets JWE and JWS is necessarily relevant to JWT. The problems with JWT being addressed are in the domain of cryptography designs, so it's natural to criticize the cryptography components. The other problem with JWT is how people use it: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...
- deleted 10y ago[deleted]
- yuhong 10y agoThe point however is that JWS/JWE is not as flawed as JWT is.
- CiPHPerCoder 10y agoYes it is. Most of the problems people point to with JWT exist in JWS or JWE.