Hacker News Reader

Comment by ceejayoz | Hacker News Reader

Sure, but that's the nuclear option. Imagine if Facebook did that every time one account was compromised or they fired a staffer?

View on HN

Facebook as the largest userbase of any application in existence. Its needs may not equate to your needs. For example, an enterprise b2b app with a few hundred customers could probably "deal with" the nuclear option.

I'd be pretty upset if I got kicked out of a work app every time one of a few hundred companies fired someone (or even had to do a password reset for a security reason).

You don't use a tool for managing your passwords? That's built into most browsers these days.

The issue is not remembering the password.

The issue is I just logged in 90 seconds ago, typed up a few paragraphs, and when I go to submit I have to do it again, because someone in another company using the tool got phished and needs a new password.

It's frustrating enough when Gmail makes me put my password in after 30 days and I just clicked into an email I wanted to read. Having it happen all day long would make me want to kill someone.

I wasn't suggesting mutating the signing key multiple times per day or once per 90 seconds. At that point, you might as well just have a very early JWT expiration timestamp specified.

The comment thread started with "if you need them to be revocable". Any tool with "a few hundred [enterprise] customers" needs to be able to revoke access for terminated employees, compromised accounts, and the like, and those revocations will occur frequently and in many cases need to have immediate impact.

A multi-tenant system could use a different key-pair for each tenant and only revoke the one for the compromised entity

Man I'm not sure I agree with that. Blowing up a bunch of your clients that rely on your services randomly because one account was compromised is not acceptable for really any professional business regardless of the number of clients.

"Blowing them up" is a mischaracterization of the situation. You are not mutating their data. You're only asking them to login again.

Actually blowing them up is a completely appropriate description if you have any non-human's relying on JWTs.

Applications that use authenticated services need to handle being the authentication being revoked. That's fairly obvious regardless of how it happens. If your app doesn't then it's broken.

Reply on news.ycombinator.com