I
Into the symmetry
blog.intothesymmetry.com · Personal blog · on HN since 2016
Into the symmetry is a security researcher's blog on cryptography and web vulnerabilities, including JWE, OAuth, SAML and elliptic curve bugs.
What HN saysHN links it for detailed vulnerability write-ups; the author himself commented that JOSE is not too bad, though some of its crypto choices are arguable.
15HN people shared it
2linked it in comments
14stories submitted
138story points
7 years agolast shared
2016people per year2026
Most-shared posts
- 1Critical Vulnerability in JSON Web Encryption (JWE) – RFC 75164 people · 16 points · first shared 2017 · 1 comments on HN
- 2The Curious Case of WebCrypto Diffie-Hellman on Firefox2 people · 81 points · first shared 2020 · 5 comments on HN
- 3The RFC 5114 saga2 people · 11 points · first shared 2016 · 1 comments on HN
- 4Slack SAML authentication bypass2 people · 4 points · first shared 2017 · discussion on HN
- 5Into the symmetry: All your Paypal OAuth tokens belong to me1 people · 15 points · first shared 2016 · discussion on HN
- 6Predicting the output of Micali-Schnorr Generator knowing the factorization1 people · 4 points · first shared 2017 · discussion on HN
- 7All your Paypal OAuth tokens belong to me – localhost for the win1 people · 3 points · first shared 2016 · discussion on HN
- 8CSRF in Facebook/Dropbox – “Mallory added a file using Dropbox”1 people · 2 points · first shared 2017 · discussion on HN
- 9Persistent XSRF on Kubernetes Dashboard – Redhat Keycloak Gatekeeper on MS Azure1 people · 1 points · first shared 2018 · discussion on HN
- 10CVE20177781/10176 Elliptic curve add in mixed Jacobian-affine coord. in FF/Java1 people · 1 points · first shared 2017 · discussion on HN
What HN people wrote when they linked it
sarakayakomzin · 2020-01-25
https://blog.intothesymmetry.com/2020/01/the-curious-case-of-webcrypto…
seems like it'll break on firefox now.
asanso · 2017-03-14
The author of http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json… here FWIW. Personally I would not be so drastic. JOSE per se is not too bad (at least the idea is cool). Some crypto choices though have been really arguable...