Hacker News new | past | comments | ask | show | jobs | submit login

> Why a new standard than to push for reform to the current standard?

Or even just an opinionated library with some basic guardrails to prevent bad configurations.




That's tempting, but as long as a standard has design flaws, there will be libraries out there that don't prevent bad configurations, and people (through innocent ignorance) will use them and end up in a bad place.


The whole point of modern cryptography is to take all the oodles of rope to hang yourself with and hand it over to the cryptographers, to leave just the absolute minimum amount of rope with the application developers.

JWT is the opposite of that. It's essentially a reenactment of the bad parts of 90s crypto, including RSA and NONE ciphers.


I mean, "basic guardrails" is basically exactly what Auth0 tried to do here with their algorithm check, and see how that turned out.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: