PAST
Security and privacy
token format
SHOW HN2018
362points
138comments
#51of 2,155 in 2018
Top 3%of 2018 by points
How HN took it
MixedNo clear lean
15 positive, 11 neutral or asking, 2 mixed, 9 critical, out of 37 comments about the project. Thread score +0.06.
Idea: 9 for, 6 againstDesign: 3 for, 2 againstExecution: 2 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Versioning instead of negotiation removes footguns
From 3 comments
This is great. Having versions instead of kitchen sinks, and having those versions get rid of the footguns, is exactly what fixes the cryptographic JWT perils. Note: you probably…
lvh on HN> In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. In my view, that's one of the big takeaways…
blattimwind on HNThis is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak "v2" of…
tptacek on HN
Clean PHP code and a respected author
From 2 comments
This library is a great example of clean and beautiful php code out in the wild!
waibelp on HNThis looks promising, and it's from a very well respected security researcher.
Lazare on HN
Objections
Public-key mode is unnecessary and risky for tokens
From 3 comments
This is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak "v2" of…
tptacek on HNThis is the logic people use when they encrypt cookies to public keys. I've never tested a system with public key encrypted cookies that wasn't broken. As a general rule of…
tptacek on HNI think you're conflating the 'seal' and 'sign' use cases. I'm not sure how one could design a secure system where encrypted cookies could either be read by everyone (encrypted…
giaour on HN
Does not stop JWT being used for stateless sessions
From 2 comments
This doesn't solve the criticism against JWT being used for sessions, which is one of the main point against JWT expressed in the very site linked at the top of the README.
Daycrawler on HNI had the impression that the main problem was that JWT was marketed as stateless and superior and then you were stuck with stolen tokens. How does PAST solve this? Is it even…
k__ on HN
Name is hard to search for
From 1 comment
I do wish a different acronym had been chosen. When I search for "[language of choice] JWT" pretty much all results are relevant. But even if this new token schema takes off it…
idbehold on HN
Requests
Explain the reasoning against public-key JWTs more clearly
From 2 comments
Your points sound very interesting but don't provide any details. Could you provide more details, I'm interested in learning about this. For instance is there a good resource you…
grogenaut on HNThe HN link doesn't explain why public key JWTs are bad; it's just more "don't use JWTs" (with the exceptionally unhelpful "as engineers, you need to understand first and…
zimpenfish on HN
Document storage guidance to avoid localStorage XSS
From 1 comment
A common security issue I've seen with uses of JWT doesn't have to do with JWT itself but how it's used by front-end developers. It's commonly stored in localStorage instead of…
timwis on HN
Questions
What is the use case for public-key tokens
From 1 comment
This is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak "v2" of…
tptacek on HN
Why not propose changes to the RFC instead
From 1 comment
Why not propose changes to the RFC instead of creating a new standard?
MrCalifornian on HN
Alternatives named
JWT
From 2 comments
This is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak "v2" of…
tptacek on HNThis is great. Having versions instead of kitchen sinks, and having those versions get rid of the footguns, is exactly what fixes the cryptographic JWT perils. Note: you probably…
lvh on HN
Random opaque tokens stored in a database
From 1 comment
This is great. Having versions instead of kitchen sinks, and having those versions get rid of the footguns, is exactly what fixes the cryptographic JWT perils. Note: you probably…
lvh on HN