DEF CON 26 CRYPTO AND PRIVACY VILLAGE - Scott Arciszewski - No Way JOSE! Designing Cryptography
Why Hacker News recommends it
HN recommends it as the video version of the argument that JOSE/JWT is a flawed standard, and as a help in understanding token design choices.
What it is
Scott Arciszewski's DEF CON 26 Crypto and Privacy Village talk critiquing the JOSE standards (JWT, JWS, JWE) and showing how to design cryptographic tokens more safely.
Recommended by 2 HN commenters across 2 different months, 2019 to 2020.
What Hacker News said
Recommends wadkar · 2020-02 · on “Javascript Object Signing and Encryption is a Bad Standard (2017)”
If you like video consumption, a DEFCON 2018 talk by the author Scott Arciszewski on this same topic can be found here: No Way JOSE! Designing Cryptography: [this video] You're welcome :) Edit: Clarify that Scott is the author of both post and video.
Recommends chriswarbo · 2020-06 · on “Hardcoded secrets, unverified tokens, and other common JWT mistakes”
I've been doing a similar thing recently. I found PASETO to be interesting ( [LINK] ), which is a lot like JWT but is simpler and more opinionated (e.g. there is no plaintext option; symmetric and asymmetric operations are cleanly separated; etc.). I especially enjoyed watching this video [this video] I still decided to go with JWT, since PASETO isn't yet standard and its software hasn't been around for long, but it definitely helped me understand more about the choice I was making. In particular, PASETO distinguishes between "local" tokens (producer and consumer can both use the same symmetric key) versus "public" tokens (producer and consumer can't use the same key, e.g. third party services ru
Cites CiPHPerCoder · 2019-01 · on “How to Use JSON Web Tokens”
Blog post: [LINK] DEFCON CPV talk: [LINK] + [this video] Alternative design that isn't radioactive: [LINK] Apologies if this wasn't more readily available or commonly known. I'm worse at marketing than I am at engineering.