[{"data":1,"prerenderedAt":569},["ShallowReactive",2],{"project-16070394":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":43,"post_text":47,"what":48,"said":89,"maker_in_thread":179,"shape":189,"grid":194,"attempts":531,"same_week":532,"maker_shows":45,"maker_hidden":562,"reader_version":563,"card":564},"16070394","PAST","A secure alternative to JWT","title","Show HN: PAST, a secure alternative to JWT","https:\u002F\u002Fgithub.com\u002Fparagonie\u002Fpast","github.com","CiPHPerCoder",1515075095,2018,362,138,51,2155,3,"legend","security_privacy","token format","library",[24,25,26,27],"jwt alternative","authentication tokens","versioned token format","libsodium","mixed",0.06,{"positive":31,"neutral":32,"mixed":33,"critical":34},15,11,2,9,37,{"design":37,"idea":38,"docs":40,"execution":42},{"positive":18,"critical":33},{"positive":34,"critical":39},6,{"positive":41,"critical":41},0,{"positive":33,"critical":41},[44,45,18,18,41,41,41,41,41,46,41,41,41,46,41,41,46,41,41,18,41,41,44,41,46,46,18,41,41,41,46,44,41,44,18,46,18,46,18,44],1,4,5,null,{"problem":49,"audience":47,"pricing":47,"motivation":65,"time_to_build":47,"stack":71,"openness":86,"stage":87,"team_size":88},{"value":50,"source":51,"evidence":52},"JWT is easy to misuse and its algorithm negotiation enables attacks","commenter",[53,57,61],{"id":54,"by":55,"text":56},"16070576","lvh","This is great. Having versions instead of kitchen sinks, and having those versions get rid of the footguns, is exactly what fixes the cryptographic JWT perils. Note: you probably…",{"id":58,"by":59,"text":60},"16070663","cheez","I'm not a security expert but when I looked into JWT I was terrified at how easy it was to screw up. Glad to see I'm not the only one.",{"id":62,"by":63,"text":64},"16070588","tptacek","This is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak \"v2\" of…",{"value":66,"source":67,"evidence":68},"Fix cryptographic footguns of JWT by using fixed, versioned protocols","inferred",[69,70],{"id":54,"by":55,"text":56},{"id":62,"by":63,"text":64},[72,79],{"value":73,"source":51,"evidence":74},"PHP",[75],{"id":76,"by":77,"text":78},"16071753","waibelp","This library is a great example of clean and beautiful php code out in the wild!",{"value":80,"source":81,"evidence":82},"Libsodium","maker",[83],{"id":84,"by":11,"text":85},"16070621","> My only nit --- apart from the \"auth enc seal sign\" names, which aren't coherent --- is why do public key at all? > Why not punt \"seal\" and \"sign\" into a \"v3\", when\u002Fif it's…","open_source","prototype","unknown",{"praise":90,"objections":108,"requests":138,"questions":157,"alternatives":169},[91,100],{"value":92,"source":51,"evidence":93},"Versioning instead of negotiation removes footguns",[94,95,99],{"id":54,"by":55,"text":56},{"id":96,"by":97,"text":98},"16070721","blattimwind","> In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. In my view, that's one of the big takeaways…",{"id":62,"by":63,"text":64},{"value":101,"source":51,"evidence":102},"Clean PHP code and a respected author",[103,104],{"id":76,"by":77,"text":78},{"id":105,"by":106,"text":107},"16070570","Lazare","This looks promising, and it's from a very well respected security researcher.",[109,120,131],{"value":110,"source":51,"evidence":111},"Public-key mode is unnecessary and risky for tokens",[112,113,116],{"id":62,"by":63,"text":64},{"id":114,"by":63,"text":115},"16071232","This is the logic people use when they encrypt cookies to public keys. I've never tested a system with public key encrypted cookies that wasn't broken. As a general rule of…",{"id":117,"by":118,"text":119},"16071806","giaour","I think you're conflating the 'seal' and 'sign' use cases. I'm not sure how one could design a secure system where encrypted cookies could either be read by everyone (encrypted…",{"value":121,"source":51,"evidence":122},"Does not stop JWT being used for stateless sessions",[123,127],{"id":124,"by":125,"text":126},"16071179","Daycrawler","This doesn't solve the criticism against JWT being used for sessions, which is one of the main point against JWT expressed in the very site linked at the top of the README.",{"id":128,"by":129,"text":130},"16073165","k__","I had the impression that the main problem was that JWT was marketed as stateless and superior and then you were stuck with stolen tokens. How does PAST solve this? Is it even…",{"value":132,"source":51,"evidence":133},"Name is hard to search for",[134],{"id":135,"by":136,"text":137},"16071475","idbehold","I do wish a different acronym had been chosen. When I search for \"[language of choice] JWT\" pretty much all results are relevant. But even if this new token schema takes off it…",[139,150],{"value":140,"source":51,"evidence":141},"Explain the reasoning against public-key JWTs more clearly",[142,146],{"id":143,"by":144,"text":145},"16071364","grogenaut","Your points sound very interesting but don't provide any details. Could you provide more details, I'm interested in learning about this. For instance is there a good resource you…",{"id":147,"by":148,"text":149},"16077807","zimpenfish","The HN link doesn't explain why public key JWTs are bad; it's just more \"don't use JWTs\" (with the exceptionally unhelpful \"as engineers, you need to understand first and…",{"value":151,"source":51,"evidence":152},"Document storage guidance to avoid localStorage XSS",[153],{"id":154,"by":155,"text":156},"16073658","timwis","A common security issue I've seen with uses of JWT doesn't have to do with JWT itself but how it's used by front-end developers. It's commonly stored in localStorage instead of…",[158,162],{"value":159,"source":51,"evidence":160},"What is the use case for public-key tokens",[161],{"id":62,"by":63,"text":64},{"value":163,"source":51,"evidence":164},"Why not propose changes to the RFC instead",[165],{"id":166,"by":167,"text":168},"16121230","MrCalifornian","Why not propose changes to the RFC instead of creating a new standard?",[170,175],{"value":171,"source":51,"evidence":172},"JWT",[173,174],{"id":62,"by":63,"text":64},{"id":54,"by":55,"text":56},{"value":176,"source":51,"evidence":177},"Random opaque tokens stored in a database",[178],{"id":54,"by":55,"text":56},{"comments":180,"answered":45,"key":181},8,[182,183,186],{"id":84,"text":85},{"id":184,"text":185},"16073589","On that note: https:\u002F\u002Fgithub.com\u002Fparagonie\u002Fpast\u002Fissues\u002F13 I might be dropping \"seal\" entirely, as its utility isn't really a good fit for security tokens. (Sealing APIs can be…",{"id":187,"text":188},"16071558","I spent two weeks (my Christmas vacation) working on rough drafts for several problems I wanted to solve in 2018. PAST was one of items I listed. (The list is here:…",{"commenters":190,"max_depth":191,"maker_replies":180,"first_comment_mins":192,"lifespan_hours":193},63,10,26,327,[195,197,199,203,205,207,211,215,218,220,222,226,228,230,232,234,237,239,242,244,247,248,250,252,255,259,262,266,269,271,273,276,278,281,283,286,288,291,294,296,299,301,303,305,308,310,312,314,315,318,321,324,327,330,332,334,335,337,339,342,344,346,349,351,353,355,357,360,362,365,367,370,373,375,377,379,381,384,387,389,392,394,397,399,402,405,408,411,413,416,419,421,423,427,429,431,433,435,438,441,443,445,447,449,451,453,456,459,461,463,465,468,471,474,477,480,481,483,487,489,491,493,495,497,500,503,505,507,509,511,513,514,517,519,522,523,525,529],[62,41,18,196,63,41],"project\u002Fmixed\u002Fdesign",[84,41,41,198,11,44],"maker\u002Fneutral\u002Fdesign",[200,41,44,201,202,41],"16075346","project\u002Fcritical\u002Fdesign","unscaled",[204,41,18,196,202,41],"16076355",[96,41,46,206,97,41],"project\u002Fpositive\u002Fdesign",[208,41,18,209,210,41],"16070746","project\u002Fneutral\u002Fdesign","eadmund",[212,41,18,213,214,41],"16070854","project\u002Fneutral\u002Fidea","davars",[216,41,41,217,55,41],"16072464","commenter\u002Fneutral\u002Fidea",[219,41,41,217,214,41],"16073845",[221,41,41,217,55,41],"16074037",[223,41,46,224,225,41],"16071049","project\u002Fpositive\u002Fidea","orf",[114,41,44,227,63,41],"project\u002Fcritical\u002Fidea",[143,41,41,229,144,41],"commenter\u002Fneutral\u002Fdocs",[231,41,41,229,63,41],"16071461",[233,41,41,229,144,41],"16071516",[235,41,41,217,236,41],"16072075","WhitneyLand",[238,41,41,229,144,41],"16072229",[240,41,41,241,55,41],"16072614","commenter\u002Fcritical\u002Fidea",[243,41,41,229,148,41],"16071530",[245,41,41,229,246,41],"16072564","atmosx",[147,41,41,229,148,41],[249,41,41,229,63,41],"16079598",[251,41,41,229,148,41],"16079874",[253,41,41,229,254,41],"16071570","owenmarshall",[256,41,41,257,258,41],"16073406","other\u002Fneutral\u002Fnone","andrewaylett",[260,41,41,229,261,41],"16074550","wglb",[263,41,41,264,265,41],"16084329","other\u002Fneutral\u002Fdesign","yuhong",[267,41,41,217,268,41],"16071560","sumnulu",[270,41,41,217,63,41],"16071616",[272,41,41,217,55,41],"16072260",[274,41,41,217,275,41],"16072328","dullgiulio",[117,41,41,277,118,41],"commenter\u002Fmixed\u002Fidea",[279,41,46,224,280,41],"16072201","davewritescode",[282,41,41,241,55,41],"16072277",[284,41,41,217,285,41],"16072602","kpil",[287,41,41,241,55,41],"16072690",[289,41,41,217,290,41],"16074484","zeveb",[292,41,41,293,63,41],"16074810","commenter\u002Fcritical\u002Fnone",[295,41,41,241,55,41],"16074875",[297,41,41,217,298,41],"16072759","WorldMaker",[300,41,41,217,55,41],"16073138",[302,41,41,217,298,41],"16073328",[304,41,41,217,55,41],"16073551",[306,41,41,217,307,41],"16074480","e12e",[309,41,41,217,55,41],"16072271",[311,41,46,224,118,41],"16072356",[313,41,41,241,55,41],"16072508",[184,41,41,209,11,44],[316,41,41,257,317,41],"16072232","hirsin",[319,41,41,217,320,41],"16073394","lawnchair_larry",[322,41,41,217,323,41],"16074442","xir78",[325,41,41,217,326,41],"16070780","cmsd2",[328,41,41,217,329,41],"16072320","logicuce",[331,41,41,241,55,41],"16072546",[333,41,41,241,329,41],"16174862",[54,44,46,224,55,41],[336,44,41,241,290,41],"16071151",[338,44,41,241,55,41],"16071401",[340,44,41,341,290,41],"16073569","commenter\u002Fneutral\u002Fperformance",[343,44,41,341,55,41],"16073674",[345,44,41,341,55,41],"16073682",[347,44,41,341,348,41],"16074316","dkersten",[350,44,41,341,55,41],"16074478",[352,44,41,341,348,41],"16077940",[354,44,41,341,55,41],"16091060",[356,44,41,341,55,41],"16075056",[358,44,18,213,359,41],"16071169","saganus",[361,44,18,213,55,41],"16071442",[363,44,41,364,359,41],"16071784","other\u002Fneutral\u002Fidea",[366,44,41,364,55,41],"16071975",[368,44,41,369,359,41],"16072006","commenter\u002Fneutral\u002Fnone",[371,44,41,364,372,41],"16072757","Shoothe",[374,44,41,217,359,41],"16073756",[376,44,41,364,372,41],"16074301",[378,44,41,364,359,41],"16075476",[380,44,41,364,372,41],"16077804",[382,44,41,364,383,41],"16072014","allyant",[385,44,44,201,386,41],"16072901","AndrewStephens",[388,44,41,341,383,41],"16077472",[390,44,41,217,391,41],"16072910","jwtfail",[393,44,41,217,202,41],"16075308",[395,44,41,364,396,41],"16073440","pinguinFromY",[398,44,41,364,307,41],"16074625",[400,33,41,364,401,41],"16072534","lxe",[403,33,46,224,404,41],"16072591","treve",[406,33,41,369,407,41],"16076480","jopsen",[409,33,46,206,410,41],"16072610","level",[412,33,46,206,298,41],"16072866",[414,33,46,224,415,41],"16073046","JepZ",[417,33,41,369,418,41],"16073206","duskwuff",[420,33,41,369,401,41],"16075349",[422,33,41,257,55,41],"16076600",[424,18,18,425,426,41],"16070714","maker\u002Fneutral\u002Fnone","atonse",[428,18,41,257,55,41],"16070828",[430,18,41,257,426,41],"16070862",[432,18,41,364,55,41],"16071018",[434,18,41,369,426,41],"16071184",[436,18,41,364,437,41],"16071433","rocky1138",[439,18,41,257,440,41],"16071265","jcadam",[442,18,41,364,426,41],"16071527",[444,18,41,364,55,41],"16071957",[446,18,41,364,440,41],"16072091",[448,18,41,364,55,41],"16072571",[450,18,41,364,440,41],"16072991",[452,18,41,364,55,41],"16073330",[454,18,46,455,236,41],"16071671","maker\u002Fpositive\u002Fidea",[457,18,41,364,458,41],"16071788","snomad",[135,45,44,460,136,41],"project\u002Fcritical\u002Fnone",[187,45,41,462,11,44],"maker\u002Fneutral\u002Fidea",[464,45,41,257,136,41],"16071919",[466,45,41,257,467,41],"16072390","cdubzzz",[469,45,41,257,470,41],"16072780","irq-1",[472,45,41,257,473,41],"16076189","audiolion",[475,45,41,257,476,41],"16073695","igammarays",[478,45,41,257,479,41],"16074687","piotrkubisa",[124,46,44,227,125,41],[482,46,41,462,11,44],"16071587",[484,46,18,485,486,41],"16071642","project\u002Fneutral\u002Fdocs","enobrev",[488,46,18,213,404,41],"16072666",[490,46,41,462,11,44],"16072999",[492,46,18,462,404,41],"16074546",[494,46,41,462,11,44],"16075871",[105,39,46,496,106,41],"project\u002Fpositive\u002Fnone",[76,498,46,499,77,41],7,"project\u002Fpositive\u002Fexecution",[501,180,44,227,502,41],"16070948","tootie",[504,180,46,224,55,41],"16071010",[506,180,18,213,144,41],"16071386",[508,180,41,485,11,44],"16071529",[510,180,46,224,55,41],"16071884",[512,180,41,217,144,41],"16072244",[154,34,18,213,155,41],[515,34,41,516,11,44],"16073714","project\u002Fneutral\u002Fnone",[518,34,44,227,55,41],"16076609",[520,191,46,499,521,41],"16075243","JimDabell",[128,32,18,213,129,41],[166,524,44,227,167,41],12,[526,527,44,227,528,41],"16071994",13,"partycoder",[58,530,41,257,59,41],14,[],[533,538,543,548,553,557],{"id":534,"name":535,"points":536,"category":537},"16090977","A simple Go web server with logging, tracing, health check",318,"languages",{"id":539,"name":540,"points":541,"category":542},"16086800","Eel",201,"dev_tools",{"id":544,"name":545,"points":546,"category":547},"16108701","Hooks Data API",145,"data",{"id":549,"name":550,"points":551,"category":552},"16095477","Pushup alarm",134,"consumer_social",{"id":554,"name":555,"points":556,"category":537},"16117047","Nerv",133,{"id":558,"name":559,"points":560,"category":561},"16075028","developer-roadmap",130,"learning_science",false,"v2",{"id":565,"name":5,"line":6,"ai":562,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":566,"maker":11,"domain":10,"tier":19,"attempts":41,"strip":567,"url":9,"mix":568,"praise":92,"objection":110,"sub":21},16070394,[24,25,26,27],"1433000005000500500300105530005101353531",[31,32,33,34],1794036562295]