Top all-time · #9454
Scott Brady
Personal blog · scottbrady91.comsecurityprogramming
Scott Brady's personal blog at scottbrady91.com covers security and programming. Since 2016, 8 different Hacker News readers have linked it 9 times, most often “Alternatives to JSON Web Tokens (JWTs)”. It is still writing: the last post was on 2026-03-13, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Scott Brady's blog for its security and authentication engineering posts, such as the case against JWTs as default session tokens, email verification, and Ed25519 key choice in SSH.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Scott Brady: Identity Consultant, Head of Engineering, Pluralsight Author, and Speaker
Most-linked posts?
- Alternatives to JSON Web Tokens (JWTs)2 people · 2 mentions · first linked 2021-05-11
What Hacker News says?
The point is that you probably don't want a truly stateless backend. What you probably want is to store a small amount of critical state in a very fast, very scalable KVS, allowing most of the backend to be stateless. So much of the discussion around JWTs boils down to "I want a stateful backend, how do I use JWTs for this?" (Answer: Not well. Why use JWTs?) Or "I have implemented a stateless backend, I'm using JWTs…
Comment linking /JOSE/Alternatives-to-JWTs
on “JWT should not be your default for sessions”Submitted Perfecting the password field with the HTML passwordrules attribute as a story · 6 points
HN discussionOh, also, another resource if you want to roll your own email verification: https://www.scottbrady91.com/Email-Verification/Python-Email...
Comment linking /Email-Verification/Python-Email-Verification-Script
on “Portier – An email-based, passwordless authentication service”Submitted Book notes and reflections: The Making of a Manager as a story · 2 points
HN discussionThe comments about Ed25519 versus Ed448 were meant for the general case of their use, and not (necessarily) strictly in the use for SSH. However, the reason for Ed25519 use in OpenSSH is because the keys are much smaller, and easier to cut/paste/etc, for the same security factor. The fact that they are faster for signing is a bonus. * https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-Se... RFC 8032 § 7.1. Te…
Comment linking /openssl/creating-rsa-keys-using-openssl
on “OpenSSH 9.5 released with keystroke timing obfuscation”Submitted Understanding JSON Web Encryption (JWE) as a story · 2 points
HN discussionSubmitted OAuth Is Not User Authorization as a story · 2 points
HN discussionSubmitted The Wrong Ways to Protect an API as a story · 2 points
HN discussionSubmitted Alternatives to JSON Web Tokens (JWTs) as a story · 1 points
HN discussion