3 ms·
I find that a claim like > Paseto is everything you love about JOSE (JWT, JWE, JWS) without any of the many design deficits that plague the JOSE standards. Ne
by sofixa 4y ago
I find that a claim like
> Paseto is everything you love about JOSE (JWT, JWE, JWS) without any of the many design deficits that plague the JOSE standards.
Needs to be substantiated. Where's the comparison? There's only a link to a website and presentation talking about the downsides of JOSE, but the only one i see for JWT is poor implementations failing when the algorithm supplied client-side is invalid. That's a trivial bug and hopefully long since fixed. Is that it?
- Nursie 4y agoI think, having given it a read in the past, the idea is a little like TLS 1.3 is to previous versions of TLS - it removes the choice to implement badly. Yes, I agree, accepting any old signature algorithm is a trivial bug in the application that uses JWTs, but I guess it's something that's happened enough to be an issue. I think the real question is - what major components/projects support these as well as/instead of JWTs? Is it reaching any sort of critical mass, or is it a well-designed curiosity?
- aPoCoMiLogin 4y agohere's the spec and comparison: https://github.com/paseto-standard/paseto-spec https://github.com/paseto-standard/paseto-spec
- ricardobeat 4y agoThis is a good start (reachable from the top link in the home page): https://paragonie.com/blog/2018/03/paseto-platform-agnostic-security-tokens-is-secure-alternative-jose-standards-jwt-etc https://paragonie.com/blog/2018/03/paseto-platform-agnostic-...