3 ms·
Ah. So it's not the use of cryptographic tokens per se that you're objecting to -- just that they're not generated and/or handled correctly.
by ScottBurson 14y ago
Ah. So it's not the use of cryptographic tokens per se that you're objecting to -- just that they're not generated and/or handled correctly.
- tptacek 14y agoI object in general to the widespread practice of using tokens that contain semantically interesting information protected by encryption.
- ScottBurson 14y agoGot it. Didn't realize that was so widespread.
- ontoillogical 14y agoYou'd be surprised to know how often it's just the username encoded in base64...