Paragon Initiative Enterprises Blog

One of the linked posts explaining why you shouldn't use JWTs is bizarre at best: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… It boils down to "there were bugs in some of the libraries" and then goes on to recommend you...pull in libsodium and do it yourself??? This is ludicrous advice that I simply can't take seriously. All software has bugs. The whole Internet lost its shit with Heartbleed, but we still use TLS and OpenSSL. > The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). I've never heard this before and can't find any evidence to back this claim up. RFC 7519 doesn't make any such claim.

Perhaps reach out to Paragon Initiative Enterprises https://paragonie.com/ They do a lot of security related work for PHP. It was them that added libsodium cryptography library to PHP. They have a few well known open source projects about cryptography and secure practices. https://paragonie.com/software

If you trust them with your keys, why not trust them with your plaintext? At which point, why bother with E2EE at all? The answer should be "because one day web browsers will be able to pin specific versions of specific web apps, with specific hashes, corresponding to specific releases tagged in their repo, which have been audited by a certain threshold of auditors that I trust". What that looks like in practice is probably some mixture of the following projects: https://github.com/kpcyrd/pacman-bintrans https://users.rust-lang.org/t/rust-code-reviews-web-site-for-cargo-cre… https://paragonie.com/blog/2022/01/solving-open-source-supply-chain-se…

> Great article. How should the community fix this problem with bad and dangerous tutorials? By updating all of the old, insecure tutorials to redirect towards secure answers instead. Details here: https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-ph…

>When sites offer both, choose U2F. When sites offer TOTP only, use it. This, 100% In some sense TOTP, basically HMAC, seems like it would be harder to screw up than a public key system. RSA is amazingly hard to get right. I wonder if the order of preference should be: 1. U2F ECDSA/EdDSA 2. TOTP 3. U2F RSA ... Infinity. SMS 2FA No idea where ECDAA [0] fits. [0]: https://paragonie.com/blog/2018/08/security-concerns-surrounding-webau…

These two articles might help: https://paragonie.com/blog/2019/03/definitive-2019-guide-cryptographic… https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.htm…

PHP makes it really easy to write insecure software, because the first googleresult is often outdated and hacked in a short time by automated scripts. The defaults of functions/methods in the standard library are often insecure. if you want to write good PHP i can recommend following resources: https://paragonie.com/software Would use their stuff if i wrote PHP https://www.phptherightway.com https://phpdelusions.net even though the name sounds abrasive it is a good resource on dbaccess if you want to know specifics. It is from a guy with several SO gold badges.

Thanks to the great folks at PARAGONIE our open source platform (ie you can actually tell the code is always the same and you can host it yourself) also just passed an independent security audit: https://paragonie.com/audit/L7TtZbFoJBxR91Xg I didn’t think it was worth it to post to HN as news, though. Perhaps I should start posting our achievements a bit more. Like for example our Group Rides feature: https://youtu.be/PHuYV7q7NeM

It's still quite impractical, m sure with some quantum computer or a custom ASIC built by those "super nerds" at the NSA its possible but but for you general adversary aka "hackers" (skiddies IMHO) it will be infeasible. What this means is for all of you [developers], is to start new projects without SHA1 and plan on migrating old ones (if it's totally necessary, normally don't unless you use SHA1 for passwords). A Great resource for those who still don't know how or what hash to use, is paragonie: https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016

Best explanation https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-con…

All three are good choices, with their own advantages and disadvantages. Argon2 may be clearly the best choice a few years from now, but both the algorithm and software implementations are immature. It's makes sense to be conservative and go with the more battle-tested options. (Also last I looked Python has no good scrypt bindings.) https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016 https://news.ycombinator.com/item?id=11118720

As a consultant for a company[1] that provide code auditing services, I welcome third-party scrutiny for the open source libraries[2] we produce. [1] https://paragonie.com [2] https://github.com/paragonie

> OAuth uses access tokens, which are typically, but not limited to, JSON Web Tokens This claim is misguided, but I hear it quite often. JWT is a very popular (and downright terrible[1]) format, but I there is no evidence that most of the tokens use JWT. It could be worse - I've heard some people claiming with confidence that OAuth mandates JWT. The reality is that OAuth 2.0 predates JWT, and the implicit assumption was that all tokens are stateful. The access tokens in the examples are all short, and the spec strongly recommends revoking access tokens in case of access code reuse. This makes JWT access tokens a non-canonical implementation of OAuth 2.0. You could add a "jti" claim (or "uti" claim in case of Microsoft) and then check for revocations in Redis, but then your only achievement was bloating up your access tokens by a factor of 20. Congratulations! That's the reason why the other Big Tech companies are not using JWT for Access Tokens. It just doesn't make sense when you are at the scale where you need access tokens to be small and moderately long-lived. Users of JWT are more heavily concentrated on the smaller scale: more recent startups and enterprise customers. --- [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard…

Unlike others, I think terrible crypto is often better than plaintext. But they would have gotten an actually secure system implemented more cheaply with less code by just copying some example code from libsodium[1]. The author(s) went to a whole lot of unnecessary effort and the result is an insecure, embarrassing mess. I would respect the argument of "oh, they're just picking a different point along the Pareto frontier between secure / high effort and insecure / low effort". But this is both insecure and high effort. People are piling on because it has the trademark smell of bad judgement. Its also a great learning opportunity. Its interesting hearing about all the security problems people who are knowledgeable in the field can spot! I noticed barely any of these problems! [1] Quick Reference, from the bottom of the article: https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-com…

I'm a developer, not a cryptographer, and like most crypto articles, most of this post is gibberish to me. I really tried to follow it in the beginning, but then I gave up, scrolled to the "what should you use instead", and then realized I didn't understand that either. If this is article is "easy" crypto, and I shouldn't roll my own crypto, then what should I do? "Just use elliptic curve crypto but make sure you choose the right curve! Here's an abbreviation for you, libsodium has it so you're all set" doesn't comfort me much. I don't have a good intuition of what a curve even is and why my sensitive data can't just go straight ahead like all the other data. I mean, when I call into libsodium with parameters I do not understand, then aren't I, for all intents and purposes, rolling my own crypto anyway? How is any of this of help? If I want to allow my customers to send me encrypted data via an untrusted channel, then what do I do? I need public key crypto for that, right? Basically, I want the public key cryptography version of Coda Hale's classic blog post about password hashing [0], does that exist? EDIT: thanks for all the comments folks, great insights! I particularly found [1] by CiPHPerCoder to be a great starting point (akin to Coda's password article) for all kinds of scenarios. I feel much more confident about this stuff now than I did 2 hours ago. [0] https://codahale.com/how-to-safely-store-a-password/ [1]…

Most of the "discussion" on this topic spins out of this blog post: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… Which unfortunately is: 1. A bit unnecessarily abrasive and hysterical in its style, and 2. Comes from a PHP consulting firm, promoting their own alternative proposal (which hardly anyone else seems to discuss or use). So I think #1 above is really about drawing eyeballs and selling services, more so than providing clear information for a newcomer to follow. JWT does have its issues, though. They basically break down into two points: 1. Because of its distributed nature, there's no built-in way to invalidate a JWT prior to its natural expiration. You have to roll your own approach for this, typically some sort of whitelist or blacklist mechanism (which defeats some of JWT's advantages). 2. By default, the spec and its major library implementations allow JWT's to specify a number of different signing algorithms (including "None"!). This is dangerously nonobvious for newbies. Best practice is to configure your code to only allow a limited number of algorithms (i.e. one).

> Context matters: That's a CLI script. Ahh, my bad, it's still an odd way of doing this. And it's vulnerable to injection via the prompt parameter (not that it matters, but...). That pattern is repeated in a couple of places like the updater. > Because when Airship was started, everyone insisted on backwards compatibility for PHP 5 and I wanted to make use of strict typing. The master branch includes a static analyzer as part of continuous integration. Strict typing is great, but you don't have to write your own framework to benefit from it. Is PHP 5 not compatible with modern frameworks? > Have you seen what I've done to PHP frameworks over the years? > https://scott.arciszewski.me/open-source/ > https://paragonie.com/security/advisories > I wasn't in a hurry to pick up other peoples' technical debt. Indeed there are some vulnerabilities found in PHP libraries in those pages, but hardly enough to warrant your position. You aren't in a hurry to pick up others technical debt, but you rush ahead and create your own? All I'm saying is you put out a post saying you designed this from the ground up to be secure, but did you really? Is rolling your own ORM and homegrown framework secure? Says who? Yeah, you use modernish stuff like csp etc, but the code is still a typical PHP spaghetti of mixed concerns and hard-to-audit flows. It's not really a CMS, it's a NIH syndromed framework with a CMS on top of that. That's a typical source of bugs. > That's simply a…

Authentication in this context means baking in a way to verify that what you receive is something you encypted and has not been altered. Or, in other words, it lets you know that the data hasn't been tampered with. As a practical example, imagine using encrypted cookies for a session store (like Rails can do), but imagine that they're not authenticated. It's possible that with clever manipulation of the encrypted cookie, I can alter the cookie such that it still decrypts into the structure ecorcyed, but with different data. For example, maybe I change the initialization vector a bit in a clever way and that makes the userId stored in the cookie change. For a more detailed explanation and hypotherical, I thought [1] was a great article. It uses PHP for the examples, but it's mostly the theory that's of interest. Of note, things are actually worse in Magento's case than this hypotherical since you can, as an attacker, get Magneto to use some pretty bad crypto when decrypting your message even if they used something decent when encrypting their payload (remember: since it's unauthenticated, what they give you and what you give back are not necessarily the same). [1] https://paragonie.com/blog/2015/05/using-encryption-and-authentication…

I'm not convinced. All the PASETO objections[0] are things that have long since been addressed by every major JOSE implementation. [0] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard…

Necessary qualifier: for browser-based user sessions. Plenty of good uses for JWTs for service-to-service communication. edit: I read some of the linked stuff, e.g. https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… . Please, if JWTs are such a horrifically insecure standard, go ahead and publish your means for hacking AWS STS's AssumeRoleWithWebIdentity , or don't publish and just exploit it by launching cryptominers in every Fortune 500 production AWS account. Let me know when you inevitably succeed, because JWTs are so insecure, right? /sarcasm

> At the very least you should propose an alternative that people use besides JWTs PASETO: https://paseto.io I thought this was common knowledge on HN? > if you're going to vaugly hand wave about the scary security issues of 2021 firebase, and 2020 Npm packages reported by Auth0. These are issues caused by the JWT standard. https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard…

I am not going to watch the talk. The slides from it are unavailable either. And sorry, but the article https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… is just weak. The only real vulnerability is the key type confusion (HS256 vs. RSA256) enabled by libraries in weakly-typed languages, and easily fixed. Other: > RSA with PKCS #1v1.5 padding is vulnerable to a type of chosen-ciphertext attack, called a padding oracle. Not applicable. > If you attempt to avoid invalid curve attacks by using one of the elliptic curves for security, you're no longer JWT standards-compliant. This is just nonsense. JWT allows Ed25519: https://www.rfc-editor.org/rfc/rfc8037 Moreover, I'm not aware of real attacks against NIST curves.

This seems still largely relevant to me: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard…

This is a good start (reachable from the top link in the home page): https://paragonie.com/blog/2018/03/paseto-platform-agnostic-security-t…

> Are you implying that every internet draft eventually becomes an RFC? No. I am saying even one of the worst designed specifications with tons of flaws and hype around it somehow made its way into being an RFC and still being used all over the internet for sessions [0] with many reasons why it is a critically flawed RFC. [1] [0] https://apibakery.com/blog/no-jwt/ [1] https://paragonie.com/blog/2021/08/paseto-is-even-more-secure-alternat…

Just wanna dump a bunch of similar PHP sites you might find useful: (The only proper) PDO tutorial: https://phpdelusions.net/pdo/ Organize a php project according to industry best practice: https://github.com/thephpleague/skeleton PHP Best Practices - A short, practical guide for common and confusing PHP tasks: https://phpbestpractices.org/ Modern PHP Cheat Sheet - A to-the-point summary of all awesome PHP features: https://front-line-php.com/cheat-sheet Laravel, PHP, JavaScript: https://freek.dev/ PHP security: https://paragonie.com/blog

I read these here: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… https://news.ycombinator.com/item?id=16070394

Average time between when a security bug is introduced in the linux kernel and when it detected is 5 years. [0] But because people don't update their shit, 99.9% of exploits in the wild involve bugs that were patched over a year ago. [0] If apple fixed a security bug in big sur, I'd like to update sooner rather than find out in a CVE next month that I should have actually upgraded ASAP. That said, waiting at least a few days to see if any problems shake out is probably a good idea. [0]: https://paragonie.com/blog/2016/10/guide-automatic-security-updates-fo…

Using Elliptic Curve cryptography would've resulted in much smaller signatures, libsodium is considered secure and has bindings to most sane/modern environments: https://download.libsodium.org/doc/ JWT also has its fair share of security issues in itself: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard…

Here's a good start: https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-soft… The big issue with PHP's security is that there are a lottt of old guides and stackoverflow answers out there with terrible, unsafe practices.