paragonie/paseto on Hacker News

…versions (v3/v4) offer cryptographic properties that JWT does not, such as exclusive ownership. https://github.com/paragonie/paseto/blob/master/docs/Rationa... ------ Also, in case it wasn't obvious: PASERK is still a work-in-progress;…

comment by CiPHPerCoder · 2021-07-30 · in Paserk: Platform Agnostic SERialized Keys

…it out, has some decent libraries for most main-stream languages. Didn't try it myself yet. [1] hxxps://github.com/paragonie/paseto

comment by n_ary · 2021-05-13 · in JWT should not be your default for sessions

…like Paseto tokens (an alternative I've heard mentioned) works by not allowing unsigned tokens: https://github.com/paragonie/paseto Is there another way to fix this? > There are libraries that will see "none" in the algo field and treat…

comment by mooreds · 2021-03-28 · in OAuth 2.0 Authentication Vulnerabilities

Just for the specific implementation. The reference implementation is the PHP version here: https://github.com/paragonie/paseto And has had a lot more attention.

comment by kingemer · 2020-06-28 · in Hardcoded secrets, unverified tokens, and other common JWT mistakes

…specifically calls this out as an insecure practice due to the possibility of replay attacks ( e.g. https://github.com/paragonie/paseto/tree/master/docs#was-sta... )

comment by chriswarbo · 2020-06-27 · in Hardcoded secrets, unverified tokens, and other common JWT mistakes

I'd like to mention here that PASETO is a safer JWT alternative: https://github.com/paragonie/paseto

comment by StavrosK · 2020-05-26 · in JWT (JSON Web Token) debugger

…in JWT). If you want to use them, use them. The parser will validate them if you want it to. https://github.com/paragonie/paseto/blob/master/src/Rules/No... https://github.com/paragonie/paseto/tree/master/docs/02-PHP-...

comment by CiPHPerCoder · 2020-04-17 · in Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful

No, it became a draft. It just hasn't become a RFC. See: https://github.com/paragonie/paseto/issues/108

comment by CiPHPerCoder · 2020-02-20 · in Javascript Object Signing and Encryption is a Bad Standard (2017)

…could come up with the same arguments against PASETO like the OP. The specification is here: https://github.com/paragonie/paseto/tree/master/docs If you can write an insecure implementation without violating the specification, please file…

comment by CiPHPerCoder · 2020-02-19 · in Javascript Object Signing and Encryption is a Bad Standard (2017)

> I can't find the specification/rfc of Paseto. https://github.com/paragonie/paseto/tree/master/docs https://paseto.io/rfc/ > It looks more of a php lib. https://paseto.io/ -- Several languages implement PASETO. > To me it seems the author…

comment by CiPHPerCoder · 2020-02-19 · in Javascript Object Signing and Encryption is a Bad Standard (2017)

…RFC. Finally, the OIDC-PASETO RFC. 1. https://tools.ietf.org/html/draft-irtf-cfrg-xchacha-03 2. https://github.com/paragonie/paseto/blob/master/docs/RFC/pas... 3. https://github.com/paragonie/paseto/issues/5

comment by CiPHPerCoder · 2020-02-18 · in JWT is Awesome

…[3]. [0] - https://github.com/fernet/spec/blob/master/Spec.md [1] - https://branca.io [2] - https://github.com/paragonie/paseto/tree/master/docs/01-Prot... [3] - https://en.wikipedia.org/wiki/Fernet-Branca

comment by rvz · 2020-02-18 · in JWT is Awesome

…negotiation. (v1 achieves a similar result with AES-CTR+HMAC-SHA384-EtM and RSASSA-PSS.) https://github.com/paragonie/paseto/tree/master/docs/01-Prot... It's similar to the advice given above, but also caters to that itch that some project…

comment by CiPHPerCoder · 2019-01-02 · in How to Use JSON Web Tokens

…can understand not only how to implement it themselves, but also why it was designed the way it is. https://github.com/paragonie/paseto/tree/master/docs Given all of the above, is it really fair to write PASETO off as an attempt to sell…

comment by CiPHPerCoder · 2019-01-02 · in How to Use JSON Web Tokens

…absolitely crucial. Would PASETO be a better fit than JWT for your envisioned WebSockets use case? https://github.com/paragonie/paseto/tree/master/docs

comment by CiPHPerCoder · 2018-11-01 · in Stop using JWT for sessions (2016)

…you must: don't do JWT for this. Just secretbox a thing and be done with it, or use PASETO[0]. [0]: https://github.com/paragonie/paseto

comment by lvh · 2018-04-03 · in Cryptographic Right Answers

…it's finalized) to solve the cryptography flaws baked into the JWT standards (collectively, JOSE): https://github.com/paragonie/past That doesn't solve the "replay attack" issue (which may be what you were referring to with bearer tokens).…

comment by CiPHPerCoder · 2018-01-17 · in Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past

PAST looks good. https://github.com/paragonie/past Basically JWT but without the pitfalls as far as I can see.

comment by scandox · 2018-01-16 · in Ask HN: What's the recommended method of adding authentication to a REST API?

…ecosystem that currently uses JWT. So I've opened an issue to address it before v1.0.0 is tagged: https://github.com/paragonie/past/issues/14

comment by CiPHPerCoder · 2018-01-04 · in Show HN: PAST, a secure alternative to JWT

On that note: https://github.com/paragonie/past/issues/13 I might be dropping "seal" entirely, as its utility isn't really a good fit for security tokens. (Sealing APIs can be very useful in other contexts, though.)

comment by CiPHPerCoder · 2018-01-04 · in Show HN: PAST, a secure alternative to JWT

This might also be of interest: https://github.com/paragonie/past/tree/master/docs/02-PHP-Li...

comment by CiPHPerCoder · 2018-01-04 · in Show HN: PAST, a secure alternative to JWT