4 ms·
> Why a new standard than to push for reform to the current standard? Or even just an opinionated library with some basic guardrails to prevent bad configurati
by pillfill 6y ago
> Why a new standard than to push for reform to the current standard?
Or even just an opinionated library with some basic guardrails to prevent bad configurations.
- kelnos 6y agoThat's tempting, but as long as a standard has design flaws, there will be libraries out there that don't prevent bad configurations, and people (through innocent ignorance) will use them and end up in a bad place.
- blattimwind 6y agoThe whole point of modern cryptography is to take all the oodles of rope to hang yourself with and hand it over to the cryptographers, to leave just the absolute minimum amount of rope with the application developers. JWT is the opposite of that. It's essentially a reenactment of the bad parts of 90s crypto, including RSA and NONE ciphers.
- joepie91_ 6y agoI mean, "basic guardrails" is basically exactly what Auth0 tried to do here with their algorithm check, and see how that turned out.