3 ms·
JWTs are a vanity project of the JS community... I am still waiting for a use case that cannot be served by traditional key exchange...
by pelagicAustral 1y ago
JWTs are a vanity project of the JS community... I am still waiting for a use case that cannot be served by traditional key exchange...
- mdaniel 1y agoDid you mean cert exchange, because keys are just a very long password, but certs carry actual information about the holder (err, I guess pedantically of the holder with the key)
- some_furry 1y ago> Did you mean cert exchange, because keys are just a very long password My experience differs: My private key is only 256 bits (32 bytes, which base64 encodes up to 44 characters, if you use padding). My typical passwords are 40-64 characters (unless stupid requirements force me to go shorter).
- Uvix 1y agoWhat algorithm are you using? RSA keys are normally at least 2048 bits in length.
- magicalhippo 1y agoI'd put money on Ed25519[1][2]. [1]: https://en.wikipedia.org/wiki/EdDSA#Ed25519 https://en.wikipedia.org/wiki/EdDSA#Ed25519 [2]: https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms https://www.iana.org/assignments/jose/jose.xhtml#web-signatu...
- some_furry 1y agoWhy would I use RSA when Ed25519 is right there?
- firesteelrain 1y ago> JWTs are a vanity project of the JS community JWTs are standardized (RFC 7519) and used outside the JS ecosystem. Not a vanity project Though often overused and poorly misunderstood where simpler and more secure methods would suffice.