5 ms·

Your points sound very interesting but don't provide any details. Could you provide more details, I'm interested in learning about this. For instance is there

Your points sound very interesting but don't provide any details. Could you provide more details, I'm interested in learning about this. For instance is there a good resource you use on what are good alternatives when you think you need to use PKI when in fact there are better alternatives? Is there a good resource on how to use JWT correctly that you trust? (Edited-tone, was a bit more aggressive but was pointing out the opportunity to educate instead of just say things are bad).

tptacek 9y ago
I'm pretty comfortable with the makeup of the subset of HN readers that take me seriously and/or understand where I'm coming from, and so I'm going to avoid litigating with strangers on this one.
- grogenaut 9y ago
  I'd still love to know the details.
  - WhitneyLand 9y ago
    My speculative interpretation (which Thomas may disavow completely) is that not that eadmund was doing something technically broken, as much as adding complexity, and risk of mistakes somewhere along the chain, without benefits to justify doing so. If you listen closely, some security wisdom could applies to a lot of specialties. For ex this quote is about authenticated encryption, but it's not really bad advice if you change the subject from encryption, to rolling your own web server: "Authenticated encryption is something you should use as a complete package, implemented as a single unit by a well-reputed open source cryptographic library and not assembled piecemeal by people who do not specialize in cryptography." So what's the difference then? The stakes are higher. Serve the wrong web page, you'll be working on a bug. Be careless with security primitives, you could make a fortune 500 stock price go down, or make your CEO have to issue a press release, which tends to not to reflect well on your performance review. In this light, "finding new reasons" I would infer to mean deviating from established best practices in any way without a damn good reason, even then without that reason being challenged and vetted. All of the creativity in security should be in the research. For production implementations I don't want any creativity. Ideally, I'd want prod to be the opposite of research: Conservative and uncreative, struggling to stay awake because it's so boring and uneventful.
    - grogenaut 9y ago
      Sure, I get all that, I want the technical details though. Or pointers to where I can learn more. His advice says what not to do but not really what to do or where to learn more.
      - lvh 9y ago
        (Hi I'm not 'tptacek, I work with him but don't speak for him) If you just want a few examples of stuff that can go wrong that doesn't go wrong if you just use a stored token instead of crypto, or doesn't go wrong if at least you use symmetric crypto instead of asymmetric crypto: - Some bugs are about negotiation, e.g. key material misuse between RSA and HMAC schemes in JWT. - Some bugs are about cryptographic implementation, such as not reusing nonces for ECDSA or RSA padding oracles or RSA keygen vulns (see Infineon bugs a few months ago). These are almost exclusively in the asymmetric crypto camp. - Some bugs are about specification issues, such as non-mandatory aud (audience) and exp (expiry). You don't have specification issues if your tokens are opaque random numbers. You have significantly less bad/fewer specification issues if your tokens are versioned and you don't allow negotiation.
- zimpenfish 9y ago
  But that also means you're missing the opportunity to educate the rest of the HN readers who would like to understand -why- something is bad (like me because we're rolling out public key JWTs). Even just a link to a blog post would be better than just "because I'm me and people agree".
  - atmosx 9y ago
    Here: https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web... https://news.ycombinator.com/item?id=13866883 https://news.ycombinator.com/item?id=13866883 https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ or go with the flow: https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=chrome..69i57.2194j0j7&sourceid=chrome&ie=UTF-8 https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=... He has countless comments preaching against JWT and DNSSEC. Mind you, I know the nickname, I know he is good with sec (I'd hire him to vet an app) and all but I don't know him IRL or ever heard of him before joining HN ... that's to say that he spent a lot of digital ink discussing these two topics here. The subset he's talking about, should amount for more than 50% of the regulars I guess.
    - zimpenfish 9y ago
      The HN link doesn't explain why public key JWTs are bad; it's just more "don't use JWTs" (with the exceptionally unhelpful "as engineers, you need to understand first and foremost that JWT is bad". How can we understand if all we get is "JWT is bad because I say it is"?) The Storify link is slightly more useful but again doesn't really explain anything - it's just bullet points of "I think these things are bad in a standard" which is great if you already have the knowledge of those things. Utterly useless otherwise. And if "implementation errors should lower your opinion of a specification" means we shouldn't use JWT, where does that leave us on WIFI, SSL, HTTP, speculative execution in pipelines, ...?
      - tptacek 9y ago
        To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". I'm criticizing JWT. Not you, or any other developer. If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives.
- owenmarshall 9y ago
  So I trust you completely here - but I lack the crypto chops to understand why that’s the case, and I’m interested in understanding. Do you have any good recommended primers that’d help me get it? Or should I just get off my arse and finally do cryptopals? ;-)
  - andrewaylett 9y ago
    Having started it but to my shame never managed to finish -- children having got in the way -- I wholeheartedly recommend the latter approach.
  - wglb 9y ago
    I would recommend doing cryptopals in any case. It will give you a good background on this and other crypto topics so you can evaluate for yourself.
yuhong 9y ago
JWS and JWE aren't as bad as JWT itself. You can use them without the JWT header.

tptacek 9y ago

I'm pretty comfortable with the makeup of the subset of HN readers that take me seriously and/or understand where I'm coming from, and so I'm going to avoid litigating with strangers on this one.

grogenaut 9y ago
I'd still love to know the details.
- WhitneyLand 9y ago
  My speculative interpretation (which Thomas may disavow completely) is that not that eadmund was doing something technically broken, as much as adding complexity, and risk of mistakes somewhere along the chain, without benefits to justify doing so. If you listen closely, some security wisdom could applies to a lot of specialties. For ex this quote is about authenticated encryption, but it's not really bad advice if you change the subject from encryption, to rolling your own web server: "Authenticated encryption is something you should use as a complete package, implemented as a single unit by a well-reputed open source cryptographic library and not assembled piecemeal by people who do not specialize in cryptography." So what's the difference then? The stakes are higher. Serve the wrong web page, you'll be working on a bug. Be careless with security primitives, you could make a fortune 500 stock price go down, or make your CEO have to issue a press release, which tends to not to reflect well on your performance review. In this light, "finding new reasons" I would infer to mean deviating from established best practices in any way without a damn good reason, even then without that reason being challenged and vetted. All of the creativity in security should be in the research. For production implementations I don't want any creativity. Ideally, I'd want prod to be the opposite of research: Conservative and uncreative, struggling to stay awake because it's so boring and uneventful.
  - grogenaut 9y ago
    Sure, I get all that, I want the technical details though. Or pointers to where I can learn more. His advice says what not to do but not really what to do or where to learn more.
    - lvh 9y ago
      (Hi I'm not 'tptacek, I work with him but don't speak for him) If you just want a few examples of stuff that can go wrong that doesn't go wrong if you just use a stored token instead of crypto, or doesn't go wrong if at least you use symmetric crypto instead of asymmetric crypto: - Some bugs are about negotiation, e.g. key material misuse between RSA and HMAC schemes in JWT. - Some bugs are about cryptographic implementation, such as not reusing nonces for ECDSA or RSA padding oracles or RSA keygen vulns (see Infineon bugs a few months ago). These are almost exclusively in the asymmetric crypto camp. - Some bugs are about specification issues, such as non-mandatory aud (audience) and exp (expiry). You don't have specification issues if your tokens are opaque random numbers. You have significantly less bad/fewer specification issues if your tokens are versioned and you don't allow negotiation.
zimpenfish 9y ago
But that also means you're missing the opportunity to educate the rest of the HN readers who would like to understand -why- something is bad (like me because we're rolling out public key JWTs). Even just a link to a blog post would be better than just "because I'm me and people agree".
- atmosx 9y ago
  Here: https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web... https://news.ycombinator.com/item?id=13866883 https://news.ycombinator.com/item?id=13866883 https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ or go with the flow: https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=chrome..69i57.2194j0j7&sourceid=chrome&ie=UTF-8 https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=... He has countless comments preaching against JWT and DNSSEC. Mind you, I know the nickname, I know he is good with sec (I'd hire him to vet an app) and all but I don't know him IRL or ever heard of him before joining HN ... that's to say that he spent a lot of digital ink discussing these two topics here. The subset he's talking about, should amount for more than 50% of the regulars I guess.
  - zimpenfish 9y ago
    The HN link doesn't explain why public key JWTs are bad; it's just more "don't use JWTs" (with the exceptionally unhelpful "as engineers, you need to understand first and foremost that JWT is bad". How can we understand if all we get is "JWT is bad because I say it is"?) The Storify link is slightly more useful but again doesn't really explain anything - it's just bullet points of "I think these things are bad in a standard" which is great if you already have the knowledge of those things. Utterly useless otherwise. And if "implementation errors should lower your opinion of a specification" means we shouldn't use JWT, where does that leave us on WIFI, SSL, HTTP, speculative execution in pipelines, ...?
    - tptacek 9y ago
      To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". I'm criticizing JWT. Not you, or any other developer. If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives.
owenmarshall 9y ago
So I trust you completely here - but I lack the crypto chops to understand why that’s the case, and I’m interested in understanding. Do you have any good recommended primers that’d help me get it? Or should I just get off my arse and finally do cryptopals? ;-)
- andrewaylett 9y ago
  Having started it but to my shame never managed to finish -- children having got in the way -- I wholeheartedly recommend the latter approach.
- wglb 9y ago
  I would recommend doing cryptopals in any case. It will give you a good background on this and other crypto topics so you can evaluate for yourself.

yuhong 9y ago

JWS and JWE aren't as bad as JWT itself. You can use them without the JWT header.