Top all-time · #7031
Mike Jones
Personal blog · self-issued.infosecurityweb
Mike Jones's personal blog at self-issued.info covers security and web. Since 2010, 11 different Hacker News readers have linked it 19 times, most often “JSON Web Tokens”. It is still writing: the last post was on 2026-09-08, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link Mike Jones's self-issued.info pages mostly as references to JSON Web Token (JWT) and OpenID Connect specification drafts, and as a source on OpenID 2.0 and token-based authentication.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- JSON Web Tokens6 people · 6 mentions · first linked 2012-08-31
What Hacker News says?
This is possible if you support the 'jti' claim[1]. There's a discussion of an implementation of it here[2]. [1]: http://self-issued.info/docs/draft-ietf-oauth-json-web-token... [2]: https://auth0.com/blog/blacklist-json-web-token-api-keys/
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Yahoo discloses hack of 1B accounts”Submitted OpenID Connect specifications published as ISO standards as a story · 306 points
HN discussionThis is water under the bridge, but it's a bit ironic to me that I had to create an account to comment here. If OpenID 2.0 had succeeded, I would be commenting with my identifier https://self-issued.info/ , which remains a valid, verifiable OpenID 2.0 identifier. You can still comment on my blog with OpenID 2.0 identifiers today. Have at it!
Comment linking /
on “OpenID Connect specifications published as ISO standards”Submitted Ten years of JSON Web Token and preparing for the future as a story · 242 points
HN discussionThe OpenID Connect specifications are and always will be available for free. See where they are available for free at https://self-issued.info/?p=2573&cpage=1#comment-393548 .
Comment linking /?p=2573&cpage=1
on “OpenID Connect specifications published as ISO standards”Submitted JSON Web Proofs BoF at IETF 114 in Philadelphia as a story · 3 points
HN discussionClient-side token based authentication is pretty well used and tested. It's even being standardized as JWT (JSON Web Token): http://self-issued.info/docs/draft-ietf-oauth-json-web-token... Additionally, there are quite a few benefits to using Token auth over cookie-based auth as well, such as not having to worry about CRSF protection: https://auth0.com/blog/2014/01/07/angularjs-authentication-w... I'd say cookies ha…
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Show HN: Satellizer – Authentication for AngularJS”Submitted OAuth DPoP specification is in the hands of the RFC Editor as a story · 2 points
HN discussionApparently the drafts have been sent to the editor so they can't be changed. [1] Oh well! [1] http://self-issued.info/?p=1323
Comment linking /?p=1323
on “Critical Vulnerabilities in JSON Web Token Libraries”Submitted Four Months of Refinements to OAuth DPoP as a story · 2 points
HN discussionAll points well taken. Still, people need to pack stuff into cookies. There are probably some modules for some environments that do this in unimpeachable fashion. How likely is the average developer to reliably pick those modules, or (haha) just code up the equivalent without using a module? At least a flawed consensus around JWT gets people looking at it. So now what? The draft [0] hasn't expired yet, so it's possi…
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Critical Vulnerabilities in JSON Web Token Libraries”Submitted JSON Web Tokens as a story · 2 points
HN discussionYes, it's essentially an app that creates online conference calls. I would have liked to ship some more features (list of participants, chatting, etc) but didn't have time. This app also showcases two early versions of NPM modules for Twilio: 1) twiliosig[1]: used to valid that HTTP requests for TwiML documents are coming from Twilio.com and not an unwanted 3rd party. 2) twilio-client-token[2]: used to generate JSON…
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Code For Twilio's Free Fantasy Football Draft Room App (Node.js + Redis)”Submitted The Journey to OpenID Federation 1.0 Is Complete as a story · 1 points
HN discussionMaybe I missed something, but I was surprised there was no mention of JSON Web Tokens (JWT). See [0] (overview) and [1] (example usage). [0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token... [1] https://github.com/mattupstate/flask-jwt
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Leveraging the Encrypted Token Pattern”Submitted Fully-Specified Algorithms for JOSE and COSE Is Now RFC 9864 as a story · 1 points
HN discussionWhere could I find a clear explanation of JWT use ? I found this document ( http://self-issued.info/docs/draft-ietf-oauth-json-web-token... ) that describes the JWT encoding. But it doesn't discribe how it is supposed to be used. Where it is stored, how it authenticates a user, etc. What makes it better than a cookie session ID ? I don't get it.
Comment linking /docs/draft-ietf-oauth-json-web-token.html
on “Reverse-Engineering Belgium: De Lijn”Submitted Fourth and Likely Last Implementer's Draft of OpenID Federation Specification as a story · 1 points
HN discussionSubmitted JSON Web Token draft 0 as a story · 1 points
HN discussion
