Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61E751A6F3B for ; Fri, 24 Jul 2015 11:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.088 X-Spam-Level: X-Spam-Status: No, score=0.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASIqMh8gKi2L for ; Fri, 24 Jul 2015 11:50:39 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0127.outbound.protection.outlook.com [207.46.100.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28C2A1A891B for ; Fri, 24 Jul 2015 11:50:38 -0700 (PDT) Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB444.namprd03.prod.outlook.com (10.141.141.154) with Microsoft SMTP Server (TLS) id 15.1.231.11; Fri, 24 Jul 2015 18:50:37 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0225.018; Fri, 24 Jul 2015 18:50:37 +0000 From: Mike Jones To: Jim Fenton , Tony Arcieri , Martin Thomson Thread-Topic: [Unbearable] JWS Thread-Index: AQHQxf2LrXyN25oYS0WGLqzBTojPR53q642AgAAKc4CAAAA6UA== Date: Fri, 24 Jul 2015 18:50:37 +0000 Message-ID: References: <55B287EB.2090301@bluepopcorn.net> In-Reply-To: <55B287EB.2090301@bluepopcorn.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: bluepopcorn.net; dkim=none (message not signed) header.d=none; x-originating-ip: [12.130.117.147] x-microsoft-exchange-diagnostics: 1; BY2PR03MB444; 5:+MSI52qqghCDS/tC4zcvkIlKlTftSFuupjz/5tXV7EX61CEgqM9YY+IXndYESVHFouu0OMH2F1bw3oRUdjPHu0HQjNrdodb5xI8qhusyNz/3n1P8HoWc9TpOgUHP+DVLnjHlWyKh52HGZoDVosIvqg==; 24:SKeaTvOdRJuCCC3Nih9ItYP6iAS6/ri7wJNaF+qhUs94fc9a5wM2PHclODeP12/xExv2DQjqxYMLfXa0/pqFgNXxZFzAtLoQDyoGiHlPEA4=; 20:Pe2oW/EUSdlwTW4QTB7X+2EHcg3NQmBVUnyNvRqMeSMGV+GjeBim/EFaC9A7/TmaJfkDWHGxsfcdd0bh0PHp5Q== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR03MB444; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB444; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB444; x-forefront-prvs: 0647963F84 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(377454003)(24454002)(479174004)(76576001)(2950100001)(87936001)(106116001)(99286002)(5001960100002)(2656002)(74316001)(77156002)(40100003)(92566002)(16236675004)(46102003)(19617315012)(62966003)(15395725005)(5001770100001)(5003600100002)(19580395003)(2900100001)(102836002)(77096005)(122556002)(19580405001)(10090500001)(15975445007)(189998001)(5002640100001)(86362001)(19625215002)(54356999)(33656002)(76176999)(50986999)(86612001)(19300405004)(66066001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB444; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2015 18:50:37.0551 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB444 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:50:41 -0000 --_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable There's lots of interoperable, tested JWS libraries now for essentially eve= ry widely-used development platform. See http://openid.net/developers/libr= aries/#jwt and http://jwt.io/, plus the blog post https://auth0.com/blog/20= 15/07/21/jwt-json-webtoken-logo/. -- Mike From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Jim Fent= on Sent: Friday, July 24, 2015 11:46 AM To: Tony Arcieri; Martin Thomson Cc: unbearable@ietf.org Subject: Re: [Unbearable] JWS On 7/24/15 11:08 AM, Tony Arcieri wrote: On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson > wrote: Why aren't we using JWS? This comes to mind: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-toke= n-libraries/ I would point to the fact that we (now) have libraries that have been vette= d as a reason to use JWS, not the other way around. (or maybe that's what you meant) -Jim --_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

There’s lots of int= eroperable, tested JWS libraries now for essentially every widely-used deve= lopment platform.  See http://openid.net/d= evelopers/libraries/#jwt and http://jwt.io/, plus the blog post https://auth0.com/blog/2015/07/21/jwt-json-webtoken-logo/.

 <= /p>

    &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;     -- Mike

 <= /p>

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Jim Fenton
Sent: Friday, July 24, 2015 11:46 AM
To: Tony Arcieri; Martin Thomson
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] JWS

 

On 7/24/15 11:08 AM, Tony Arcieri wrote:<= /p>

On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson <= martin.thomso= n@gmail.com> wrote:


I would point to the fact that we (now) have libraries that have been vette= d as a reason to use JWS, not the other way around.

(or maybe that's what you meant)

-Jim

--_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_--