3 ms·
If you, like me, prefer HN comments over articles: The author does not just complain about JOSE and JWT but he also designed an alternative, PASETO: https://pa
by skrebbel 7y ago
If you, like me, prefer HN comments over articles:
The author does not just complain about JOSE and JWT but he also designed an alternative, PASETO: https://paseto.io/ https://paseto.io/
Here's a nice PASETO write-up from Okta, a reputable third party: https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-paseto https://developer.okta.com/blog/2019/10/17/a-thorough-introd...
PASETO looks excellent to me, in that it's proper developer friendly and makes it hard for non crypto nerds like me to shoot themselves in the foot. I can't wait for it to replace JWT in popularity.
- badrabbit 7y agoThat's nice and all but standards exist for a reason. You ask devs to use it in order to be compliant. Regardless of merits, you can't ask people who are not knowledgable about crypto to use a library by some guy/corp just because you think it has better merits. I mean, I guess you can and some will listen but only a few. Most webdevs for non-web businesses are happy to go with a standard so if something goes wrong they don't get blamed for picking it. And many security/vulnerability pros agree with that line of thinking as well. In practice,if paseto is better I think an internet draft is in order. If JSOE is bad by commonly accepted security measurements then shouldn't the ietf wg have a mailing list where these shortcomings can be discussed and fixed?
- CiPHPerCoder 7y ago> In practice,if paseto is better I think an internet draft is in order. https://paseto.io/rfc/ https://paseto.io/rfc/
- badrabbit 7y agoIt would be great if it at least becomes a draft. Did IETF simply ignore the proposal since 2018?
- CiPHPerCoder 7y agoNo, it became a draft. It just hasn't become a RFC. See: https://github.com/paragonie/paseto/issues/108 https://github.com/paragonie/paseto/issues/108