4 ms·

No, you're not wrong. But I would go further and say JWTs should be obsoleted by using an object-capability model (see: http://habitatchronicles.com/2017/05/wha

No, you're not wrong. But I would go further and say JWTs should be obsoleted by using an object-capability model (see: http://habitatchronicles.com/2017/05/what-are-capabilities/ http://habitatchronicles.com/2017/05/what-are-capabilities/ ) which is a more fleshed out way of using unique unforgeable "tokens" to access things. The ocap model is tailor made to solve the problem that CSRF is an instance of (confused deputy attacks).

monocasa 5y ago
I was under the impression that the right way to use JWTs is as object capabilities, much like Kerberos tickets. Can you expand a little more on how you believe they should be used versus how they shouldn't?
- anaphor 5y ago
  I guess it depends on how you use it yeah, like the token can be used to refer to a specific resource, which is then granted to whoever has the token. But obviously you can just treat them as a way of doing traditional identity based access control if you want, which isn't the most effective way of using them. JWTs don't let you easily revoke them, or narrow access to specific resources. That's something you have to do yourself, or rely on a library to do, but that would be built into an ocap based system.
benlivengood 5y ago
Do you know of any proposals for browsers to directly use capabilities? Servers can implement a strict capability model for server-side objects but the browser's granularity for a capability owner is almost useless. To be fair, no popular operating system makes much of a distinction between the human operator, the operator's actions via I/O, the behavior of applications ostensibly started by the user, and various other automatically started software, so at least browsers provide the concept of a domain for separate ownership.
- anaphor 5y ago
  The most promising things I know of are Google Fuchsia (which is a mobile OS), and Goblins, which is a Scheme library for doing distributed programming. There is something called Realms which is being worked on for JS, but I haven't dug into it too deeply yet. It might provide a good foundation for building ocaps into the browser, though. https://github.com/tc39/proposal-realms https://github.com/tc39/proposal-realms https://en.wikipedia.org/wiki/Google_Fuchsia https://en.wikipedia.org/wiki/Google_Fuchsia https://docs.racket-lang.org/goblins/index.html https://docs.racket-lang.org/goblins/index.html

monocasa 5y ago

I was under the impression that the right way to use JWTs is as object capabilities, much like Kerberos tickets. Can you expand a little more on how you believe they should be used versus how they shouldn't?

anaphor 5y ago
I guess it depends on how you use it yeah, like the token can be used to refer to a specific resource, which is then granted to whoever has the token. But obviously you can just treat them as a way of doing traditional identity based access control if you want, which isn't the most effective way of using them. JWTs don't let you easily revoke them, or narrow access to specific resources. That's something you have to do yourself, or rely on a library to do, but that would be built into an ocap based system.

benlivengood 5y ago

Do you know of any proposals for browsers to directly use capabilities? Servers can implement a strict capability model for server-side objects but the browser's granularity for a capability owner is almost useless. To be fair, no popular operating system makes much of a distinction between the human operator, the operator's actions via I/O, the behavior of applications ostensibly started by the user, and various other automatically started software, so at least browsers provide the concept of a domain for separate ownership.

anaphor 5y ago
The most promising things I know of are Google Fuchsia (which is a mobile OS), and Goblins, which is a Scheme library for doing distributed programming. There is something called Realms which is being worked on for JS, but I haven't dug into it too deeply yet. It might provide a good foundation for building ocaps into the browser, though. https://github.com/tc39/proposal-realms https://github.com/tc39/proposal-realms https://en.wikipedia.org/wiki/Google_Fuchsia https://en.wikipedia.org/wiki/Google_Fuchsia https://docs.racket-lang.org/goblins/index.html https://docs.racket-lang.org/goblins/index.html