Top all-time · #7898
Semantically Secure
Personal blog · scottarc.blog · on HN as CiPHPerCodersecurityprogramming
Semantically Secure is a personal blog at scottarc.blog about security and programming. Since 2022, 9 different Hacker News readers have linked it 24 times, most often “How to Write a Secure JWT Library If You Must”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link this blog's post on Police CyberAlarm, a security scanning tool, as a source on its poor security. Another comment discusses nonce reuse and key-wrapping in encryption modes.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Semantics, semantic security, security.
Most-linked posts?
- How to Write a Secure JWT Library If You Must4 people · 6 mentions · first linked 2023-09-06
- Trust Rules Everything Around Me3 people · 3 mentions · first linked 2024-10-14
- Encryption at Rest: Whose Threat Model Is It Anyway?2 people · 2 mentions · first linked 2024-06-03
- Police CyberAlarm Uses Alarming Cryptography2 people · 2 mentions · first linked 2022-07-04
What Hacker News says?
> The article misses the point of JWT: it's dead simple to implement. Implementing it securely , however, is far from dead simple. https://scottarc.blog/2023/09/06/how-to-write-a-secure-jwt-l...
Comment linking /2023/09/06/how-to-write-a-secure-jwt-library-if-you-absolutely-must/
on “Should I use JWTs for authentication tokens?”Submitted Encryption at Rest: Whose Threat Model Is It Anyway? as a story · 199 points
HN discussionI've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2]. I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it. Also, I don't think ident…
Comment linking /2024/04/04/open-source-supply-chains-and-bears-oh-my/
on “XZ backdoor story – Initial analysis”Submitted Police CyberAlarm Uses Alarming Cryptography as a story · 180 points
HN discussionHopefully it's slightly less pathetic than the "Police CyberAlarm". https://paul.reviews/police-cyberalarm-abysmal-security-yet-... https://scottarc.blog/2022/07/04/police-cyberalarm-uses-alar...
Comment linking /2022/07/04/police-cyberalarm-uses-alarming-cryptography/
on “UK Government scans all web servers hosted in the UK for vulnerabilities”Submitted Attacking NIST SP 800-108 (Loss of Key Control Security) as a story · 42 points
HN discussionWhile I appreciate the sentiment, I don't know that a hard fork is necessarily the right answer. https://scottarc.blog/2024/10/14/trust-rules-everything-arou...
Comment linking /2024/10/14/trust-rules-everything-around-me/
on “ACF has been hijacked”Submitted Open Source, Supply Chains, and Bears as a story · 18 points
HN discussion> All the criticism of cryptographic agility that I have seen has involved an attacker negotiating a downgrade to a broken protocol. Consider this an additional data point, then: https://paragonie.com/blog/2019/10/against-agility-in-crypto... In the years since I wrote that, several people have pointed out that "versioned protocols" are just a safe form of "crypto agility". However, when people say "crypto agility',…
Comment linking /2023/09/06/how-to-write-a-secure-jwt-library-if-you-absolutely-must/
on “Quantum is unimportant to post-quantum”Submitted A WordPress Hard Fork Could Be Made Painless for Plugin/Theme Developers as a story · 5 points
HN discussion> whereas I can’t think of an instance where a repeated CTR nonce wasn’t game-over. The fact that you can’t think of an example is not a serious security argument. This is why we have rigorous security definitions rather than hand waving “I can’t think of anything” arguments, which should have died in the 90s. I already gave you one example: key-wrapping. JOSE (of course) has a key-wrapping mode based on GCM, and at…
Comment linking /2023/09/06/how-to-write-a-secure-jwt-library-if-you-absolutely-must/
on “On the Impending Crypto Monoculture (2016)”Submitted Trust Rules Everything Around Me as a story · 5 points
HN discussionSubmitted The Quest for the Gargon (Argon2 and FIPS) as a story · 5 points
HN discussionSubmitted Trust Rules Everything Around Me as a story · 3 points
HN discussionSubmitted Encryption at Rest: Whose Threat Model Is It Anyway? as a story · 2 points
HN discussionSubmitted Lucid Multi-Key Deputies Require Commitment as a story · 2 points
HN discussionSubmitted Toward Hybrid Post-Quantum Signatures as a story · 2 points
HN discussionSubmitted Attacking NIST SP 800-108 (Loss of Key Control Security) as a story · 1 points
HN discussionSubmitted Loss of Key Control Security in NIST SP 800-108 as a story · 1 points
HN discussionSubmitted How to Write a Secure JWT Library If You Must as a story · 1 points
HN discussionSubmitted How to Write a Secure JWT Library If You Must as a story · 1 points
HN discussionSubmitted How to Write a Secure JWT Library If You Must as a story · 1 points
HN discussionSubmitted Innovations in the AWS Database Encryption SDK as a story · 1 points
HN discussionSubmitted We Need Non-Interactive Post-Quantum KEMs as a story · 1 points
HN discussion