4 ms·
Can you expand? JWT are a good way to remove state from the service and the HMAC lets you trust it. This looks like an implementation bug, which is unfortunate,
by nosir33 12y ago
Can you expand? JWT are a good way to remove state from the service and the HMAC lets you trust it. This looks like an implementation bug, which is unfortunate, but not a reason to avoid the technology.
- tptacek 12y agoI wrote 10 warning signs of bad crypto standards on Twitter a few minutes ago, largely inspired by JWT.
- jessaustin 12y agoAll points well taken. Still, people need to pack stuff into cookies. There are probably some modules for some environments that do this in unimpeachable fashion. How likely is the average developer to reliably pick those modules, or (haha) just code up the equivalent without using a module? At least a flawed consensus around JWT gets people looking at it. So now what? The draft [0] hasn't expired yet, so it's possible they'll just rip out the public-key stuff. What should they add to answer your reservations about CTR+HMAC? [0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html http://self-issued.info/docs/draft-ietf-oauth-json-web-token...
- jessaustin 12y agoApparently the drafts have been sent to the editor so they can't be changed. [1] Oh well! [1] http://self-issued.info/?p=1323 http://self-issued.info/?p=1323