Top all-time · #10730
zofrex.com
Personal blog · zofrex.com/blogsecurityprogramming
zofrex.com is a personal blog at zofrex.com about security and programming. Since 2020, 7 different Hacker News readers have linked it 7 times, most often “I Found an Alg=None JWT Vulnerability in the NHS Contact Tracing App”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link zofrex.com's posts on JWT security problems, such as its alg:none vulnerability post, as material on why JWTs are easy to get wrong. The comments do not discuss the writing itself.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Adventures in infosec, devops, and testing
Most-linked posts?
- I Found an Alg=None JWT Vulnerability in the NHS Contact Tracing App5 people · 5 mentions · first linked 2020-10-20
- Bundler Is Still Vulnerable to Dependency Confusion Attacks2 people · 2 mentions · first linked 2021-04-29
What Hacker News says?
There's a lot of material out there explaining what's wrong with JWTs. Two of my recent favourites: https://groups.google.com/g/django-developers/c/6oS9R2GwO4k/... - on the Django mailing list https://www.zofrex.com/blog/2020/10/20/alg-none-jwt-nhs-cont... - where the punchline is "Writing the code to sign data with a private key and verify it with a public key would have been easier to get correct than correctly in…
Comment linking /blog/2020/10/20/alg-none-jwt-nhs-contact-tracing-app/
on “API Tokens: A Tedious Survey”Submitted I Found an Alg=None JWT Vulnerability in the NHS Contact Tracing App as a story · 5 points
HN discussion> * JWT can be secure if you are careful https://www.howmanydayssinceajwtalgnonevuln.com/ https://www.zofrex.com/blog/2020/10/20/alg-none-jwt-nhs-cont... https://twitter.com/SchmiegSophie/status/1413248896227155968 https://twitter.com/tqbf/status/1414087907938377735 etc. > * there is wide support for JWT. (See for example this IETF draft https://datatracker.ietf.org/doc/html/draft-ietf-oauth-acces... as well as the…
Comment linking /blog/2020/10/20/alg-none-jwt-nhs-contact-tracing-app/
on “Paserk: Platform Agnostic SERialized Keys”Submitted Bundler Is Still Vulnerable to Dependency Confusion Attacks as a story · 3 points
HN discussionSubmitted I Found an Alg=None JWT Vulnerability in the NHS Contact Tracing App as a story · 2 points
HN discussionSubmitted How I Found an Alg=None JWT Vulnerability in the NHS Contact Tracing App as a story · 2 points
HN discussionSubmitted Bundler Is Still Vulnerable to Dependency Confusion Attacks (CVE – 2020 – 36327) as a story · 1 points
HN discussion
