3 ms·

It definitely allows replay attacks. If you manage to get someone's JWT you can impersonate them for a couple of hours before it expires, unless the website has

It definitely allows replay attacks. If you manage to get someone's JWT you can impersonate them for a couple of hours before it expires, unless the website has additional identity verification measures like known IP addresses and such. As you say, connections are now all encrypted so the old prank methods of stealing peoples' tokens off university wifi networks won't work anymore. I've definitely seen JWTs show up in logs, though.

user5994461 6y ago
"known IP addresses and such" does not work for websites authentication and such. Mobile clients are changing IP all the time as they move between WIFIs and mobile networks. That's one of the many limitations of kerberos. It's really not intended to work outside of a company intranet.
- cryptonector 6y ago
  Uh, u/ahelwer was talking about JWT, not Kerberos. Kerberos doesn't scale to the Internet as it stands, but used properly it's secure. The problem that u/ahelwer says JWT... Kerberos also has when used in HTTP -- as opposed to other uses of Kerberos that don't have this problem. That problem is that they are used as "bearer tokens" without any "channel binding", so if you use them over HTTP without TLS, you lose to any eavesdroppers, and if you use them over HTTPS using the WebPKI and some CA is being (ab)used to MITM you, then you lose. This isn't specific to JWT (or Kerberos) but generic to all small-b bearer token schemes.
  - user5994461 6y ago
    I thought this was talking about JWT not restricting by IP specifically because Kerberos does. Kerberos has very stringent requirements to onboard and preregister user devices, that works in limited contexts like desktop or server authentication in an intranet. JWT is intended to cover other use cases like web authentication. Their (non) limitations are simply reflections of their use cases.
    - cryptonector 6y ago
      Kerberos doesn't restrict by IP address anymore -- it can, but it's optional and most sites avoid it.

user5994461 6y ago

"known IP addresses and such" does not work for websites authentication and such. Mobile clients are changing IP all the time as they move between WIFIs and mobile networks. That's one of the many limitations of kerberos. It's really not intended to work outside of a company intranet.

cryptonector 6y ago
Uh, u/ahelwer was talking about JWT, not Kerberos. Kerberos doesn't scale to the Internet as it stands, but used properly it's secure. The problem that u/ahelwer says JWT... Kerberos also has when used in HTTP -- as opposed to other uses of Kerberos that don't have this problem. That problem is that they are used as "bearer tokens" without any "channel binding", so if you use them over HTTP without TLS, you lose to any eavesdroppers, and if you use them over HTTPS using the WebPKI and some CA is being (ab)used to MITM you, then you lose. This isn't specific to JWT (or Kerberos) but generic to all small-b bearer token schemes.
- user5994461 6y ago
  I thought this was talking about JWT not restricting by IP specifically because Kerberos does. Kerberos has very stringent requirements to onboard and preregister user devices, that works in limited contexts like desktop or server authentication in an intranet. JWT is intended to cover other use cases like web authentication. Their (non) limitations are simply reflections of their use cases.
  - cryptonector 6y ago
    Kerberos doesn't restrict by IP address anymore -- it can, but it's optional and most sites avoid it.