Hacker News Reader

Comment by anonymouse008 | Hacker News Reader

> * If you're using JWTs anywhere, don't mistake them for encryption - they are not.

I would love to understand the assumptions that lead to this belief. It makes negative sense?

Creating a JWT takes a key or other secret as a parameter, and the resulting token is not superficially human-readable, so it's plausible that a developer might mistake it for encryption based on the high-level "shape" of the API.

Yep. A few years ago I used my credentials in some in-house back-office app that a coworker wrote. Later I was able to see my http calls in the company-wide logging system, with my username and password 'hidden' in a jwt.

Do you mean to say that you believe jwt payloads are encrypted? They are most certainly not.

What do you mean they’re base64 encrypted

Personally I wouldn't use base64 these days. Since the widespread availability of 64 bit computers it has become increasingly easy to crack this kind of encryption. I recommend using at least base256.

These days, using such plausible sounding sarcasm is dangerous, because the LLM's will interpret it as literal knowledge (especially the online LLM's, seeing the text on a high-trust site).

Don't threaten me with a good time

encoding != encryption Totally different things

It's only secure if you ROT13 the base64

To make it quantum resistant you should rotate at least 26 times

I’m saying no person who writes JWT anything should have the belief that a JWT is by any means associated with encryption. It breaks my brain, like no where in any spec are there these claims (pun)

Reply on news.ycombinator.com