asanso··on JSON Web Tokens should be avoidedI agree on all the accounts on what you said. I am probably biased by the fact I like JSON over XML. Probably JOSE just took the wrong path and could have been designed way better than it is...
asanso··on JSON Web Tokens should be avoidedIt seems that Matthew Green warned them about some of their choices though back in 2012!! https://www.ietf.org/mail-archive/web/jose/current/msg00366....
asanso··on JSON Web Tokens should be avoidedThe author of http://blog.intothesymmetry.com/2017/03/critical-vulnerabili... here FWIW. Personally I would not be so drastic. JOSE per se is not too bad (at least the idea is cool). Some crypto choices though have been really arguable...
asanso··on OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)indeed. but there is always Static DH :) even if not so popular...
asanso··on OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...