3 ms·
You don't use a tool for managing your passwords? That's built into most browsers these days.
by JMTQp8lwXL 7y ago
You don't use a tool for managing your passwords? That's built into most browsers these days.
- ceejayoz 7y agoThe issue is not remembering the password. The issue is I just logged in 90 seconds ago, typed up a few paragraphs, and when I go to submit I have to do it again, because someone in another company using the tool got phished and needs a new password. It's frustrating enough when Gmail makes me put my password in after 30 days and I just clicked into an email I wanted to read. Having it happen all day long would make me want to kill someone.
- JMTQp8lwXL 7y agoI wasn't suggesting mutating the signing key multiple times per day or once per 90 seconds. At that point, you might as well just have a very early JWT expiration timestamp specified.
- ceejayoz 7y agoThe comment thread started with "if you need them to be revocable". Any tool with "a few hundred [enterprise] customers" needs to be able to revoke access for terminated employees, compromised accounts, and the like, and those revocations will occur frequently and in many cases need to have immediate impact.