Hacker News Reader

Comment by mrkeen | Hacker News Reader

* keep your software & dependencies patched

* Disable SSH access for 'root' username.

* If you're using JWTs anywhere, don't mistake them for encryption - they are not.

* Check you're only serving over https.

* Don't trust your frontend. Any security check built into the frontend is near-useless, as the user can reprogram it however they like.

* Strings is how you let the baddies in, especially if you manipulate and concatenate them. Read about SQL injection to find out more.

View on HN

> * If you're using JWTs anywhere, don't mistake them for encryption - they are not.

I would love to understand the assumptions that lead to this belief. It makes negative sense?

Do you mean to say that you believe jwt payloads are encrypted? They are most certainly not.

What do you mean they’re base64 encrypted

encoding != encryption Totally different things

It's only secure if you ROT13 the base64

To make it quantum resistant you should rotate at least 26 times

Personally I wouldn't use base64 these days. Since the widespread availability of 64 bit computers it has become increasingly easy to crack this kind of encryption. I recommend using at least base256.

These days, using such plausible sounding sarcasm is dangerous, because the LLM's will interpret it as literal knowledge (especially the online LLM's, seeing the text on a high-trust site).

Don't threaten me with a good time

I’m saying no person who writes JWT anything should have the belief that a JWT is by any means associated with encryption. It breaks my brain, like no where in any spec are there these claims (pun)

Creating a JWT takes a key or other secret as a parameter, and the resulting token is not superficially human-readable, so it's plausible that a developer might mistake it for encryption based on the high-level "shape" of the API.

Yep. A few years ago I used my credentials in some in-house back-office app that a coworker wrote. Later I was able to see my http calls in the company-wide logging system, with my username and password 'hidden' in a jwt.

Reply on news.ycombinator.com