4 ms·

this is "symmetric cryptography" in the article at the top of the page

tchaffee 9y ago
"symmetric cryptography" is not mentioned in your article. And I specifically asked for example implementations, which is something Auth0 gives me for just about every platform. If your goal is to have programmers act on this information, the alternative(s) should to be as easy as the implementation you are moaning about. Especially when the claim is that JWT is overly complicated. Show us the simpler alternative, spelled out as well as the Auth0 team spell it out, and maybe us non-crypto experts will bite.
- tptacek 9y ago
  The protocol is complicated. It's evident to everybody that the library implementations are simple, which is why so many people with no background in cryptography have such strong feelings about JWT. We get it: they made it very easy for you to do the wrong thing, and you'd rather things stay easy. I sincerely sympathize with your problem. But it is a problem.
  - tchaffee 9y ago
    Thanks for recognizing no one (as far as I know) has made it easy to do the right thing. Yet. Since it sounds like doing the right thing might not actually be that difficult, why haven't market forces taken over? Since many are willing to pay for Auth0 services, why isn't there a similar product that isn't built on JWT and that gets the approval of the crypto community? I would pay for it. I bet others would. I want to focus on building my web app and API and the user experience. I don't want to have to worry that I've made a mistake with authentication, which is outside my area of expertise. I would bet that describes a huge number of programmers creating public facing apps.
  - yuhong 9y ago
    And it is not like even AES-CBC + HMAC is particularly hard to write. (you should remember to encrypt-then-MAC or even better use AEAD these days)
    - kevinburke 9y ago
      If you have to append "you should remember" to cryptographic instructions, I would argue they are hard.
- kevinburke 9y ago
  sure, here's some code I use in Go to encrypt and decrypt cookies and OAuth state objects https://github.com/kevinburke/go-html-boilerplate/blob/master/crypto.go https://github.com/kevinburke/go-html-boilerplate/blob/maste...
  - tchaffee 9y ago
    Thanks for the example, but I don't use Go and don't plan on learning it just to understand how to switch from using JWT. I need an example for a React frontend consuming a nodejs API (that's just one example). I hope you're getting the idea that these many anti-JWT articles are strong on complaining but weak on providing a solution as well documented with examples as the Auth0 team has provided. Flawed or not, JWT is being used because there are parts (like sample code in many languages) of the JWT offering that are better than what's offered by an article complaining about JWT.
    - kevinburke 9y ago
      In general, implementing non-cryptographically-secure protocols is easier than implementing cryptographically secure tools; there are many ways to set up something insecurely. I recently set up libsodium for a client running Node.js on the server, and could work on this for you as well, if you want to send me an email, I can send you my rates.
      - tchaffee 9y ago
        What's your value proposition? Auth0 works for me, has a free tier, and my users' data is not anything so private. On the server side I only accept the HMAC-SHA256 algorithm, negating your biggest concern about JWT. Perhaps, as you claim in your article, that "is not JWT". I'm ok with that. How would your services save me money or increase my profit? I would be far more interested in a freemium SaaS alternative to Auth0 that fixes the concerns with JWT than I would be in paying an individual consultant (who might or might not be a crypto / auth expert - hard for me to verify) and who could be hit by a bus.

"symmetric cryptography" is not mentioned in your article. And I specifically asked for example implementations, which is something Auth0 gives me for just about every platform. If your goal is to have programmers act on this information, the alternative(s) should to be as easy as the implementation you are moaning about. Especially when the claim is that JWT is overly complicated. Show us the simpler alternative, spelled out as well as the Auth0 team spell it out, and maybe us non-crypto experts will bite.

tptacek 9y ago
The protocol is complicated. It's evident to everybody that the library implementations are simple, which is why so many people with no background in cryptography have such strong feelings about JWT. We get it: they made it very easy for you to do the wrong thing, and you'd rather things stay easy. I sincerely sympathize with your problem. But it is a problem.
- tchaffee 9y ago
  Thanks for recognizing no one (as far as I know) has made it easy to do the right thing. Yet. Since it sounds like doing the right thing might not actually be that difficult, why haven't market forces taken over? Since many are willing to pay for Auth0 services, why isn't there a similar product that isn't built on JWT and that gets the approval of the crypto community? I would pay for it. I bet others would. I want to focus on building my web app and API and the user experience. I don't want to have to worry that I've made a mistake with authentication, which is outside my area of expertise. I would bet that describes a huge number of programmers creating public facing apps.
- yuhong 9y ago
  And it is not like even AES-CBC + HMAC is particularly hard to write. (you should remember to encrypt-then-MAC or even better use AEAD these days)
  - kevinburke 9y ago
    If you have to append "you should remember" to cryptographic instructions, I would argue they are hard.
kevinburke 9y ago
sure, here's some code I use in Go to encrypt and decrypt cookies and OAuth state objects https://github.com/kevinburke/go-html-boilerplate/blob/master/crypto.go https://github.com/kevinburke/go-html-boilerplate/blob/maste...
- tchaffee 9y ago
  Thanks for the example, but I don't use Go and don't plan on learning it just to understand how to switch from using JWT. I need an example for a React frontend consuming a nodejs API (that's just one example). I hope you're getting the idea that these many anti-JWT articles are strong on complaining but weak on providing a solution as well documented with examples as the Auth0 team has provided. Flawed or not, JWT is being used because there are parts (like sample code in many languages) of the JWT offering that are better than what's offered by an article complaining about JWT.
  - kevinburke 9y ago
    In general, implementing non-cryptographically-secure protocols is easier than implementing cryptographically secure tools; there are many ways to set up something insecurely. I recently set up libsodium for a client running Node.js on the server, and could work on this for you as well, if you want to send me an email, I can send you my rates.
    - tchaffee 9y ago
      What's your value proposition? Auth0 works for me, has a free tier, and my users' data is not anything so private. On the server side I only accept the HMAC-SHA256 algorithm, negating your biggest concern about JWT. Perhaps, as you claim in your article, that "is not JWT". I'm ok with that. How would your services save me money or increase my profit? I would be far more interested in a freemium SaaS alternative to Auth0 that fixes the concerns with JWT than I would be in paying an individual consultant (who might or might not be a crypto / auth expert - hard for me to verify) and who could be hit by a bus.