3 ms·
"known IP addresses and such" does not work for websites authentication and such. Mobile clients are changing IP all the time as they move between WIFIs and mob
by user5994461 6y ago
"known IP addresses and such" does not work for websites authentication and such. Mobile clients are changing IP all the time as they move between WIFIs and mobile networks.
That's one of the many limitations of kerberos. It's really not intended to work outside of a company intranet.
- cryptonector 6y agoUh, u/ahelwer was talking about JWT, not Kerberos. Kerberos doesn't scale to the Internet as it stands, but used properly it's secure. The problem that u/ahelwer says JWT... Kerberos also has when used in HTTP -- as opposed to other uses of Kerberos that don't have this problem. That problem is that they are used as "bearer tokens" without any "channel binding", so if you use them over HTTP without TLS, you lose to any eavesdroppers, and if you use them over HTTPS using the WebPKI and some CA is being (ab)used to MITM you, then you lose. This isn't specific to JWT (or Kerberos) but generic to all small-b bearer token schemes.
- user5994461 6y agoI thought this was talking about JWT not restricting by IP specifically because Kerberos does. Kerberos has very stringent requirements to onboard and preregister user devices, that works in limited contexts like desktop or server authentication in an intranet. JWT is intended to cover other use cases like web authentication. Their (non) limitations are simply reflections of their use cases.
- cryptonector 6y agoKerberos doesn't restrict by IP address anymore -- it can, but it's optional and most sites avoid it.