They edited the payload first but signature was never changed. A JWT's signature changes if payload changes; so it was never about the "none" algo, it was that Microsoft never validated the JWT with their signing key.
JWT is a great tool, Microsoft just failed to use it correctly.
Argh, I missed that it actually uses the "none" algorithm. Yeah, the existence of that option is extremely dumb and it shouldn't be possible to use that. I misread the post and thought it was a regular JWT, but they simply didn't validate it.
Other commenters are suggesting you can’t blame the spec for end implementation mistakes, except that’s one of the many issues - JWT being so error-prone is a problem.
I use JWT just for handling of tokens, because it’s so well supported, but I won’t use it for anything more than token storage _because_ it is so vulnerable to mistakes.
The fact that mistakes are so easy to make is indicative of poor design in the spec itself.
Does this extend to OIDC? I’m not knowledgeable on the topic but it uses JWT right? Is it also prone to poor implementation? If you just error on alg=none does that solve it?
This comment could use some elaboration. For those that don't know you can use a Yubikey that supports PIV as a smart card for logging into macOS and performing a range of admin authentication operations with just the PIN, not just in the GUI but sudo as well (and of course more directly for SSH etc). It's not a perfect substitute, no ApplePay, but it means you can have a long complex password and only need a 6-8 digit PIN for most usage while still being pretty safe, and has some positives of its own in a multiuser or machine environment. It's a very reasonable option to consider IMO, even though yes it'd absolutely be nice if Apple did better on the hardware auth front.
Your comment just reminded me I can use my Yubikey to unlock my Linux laptop but hadn't set this up yet. I've been typing my password each time like an animal! Thanks. :-)
This is nothing new. Wifi signals have been used to detect objects, people and animals, gait analysis[1], read keystrokes[2], monitor breathing and heart rates[3], "hear" conversations[4], etc for at least a decade now.
Have you gotten any of these to work? A few years ago I was tasked with investigating these kinds of techniques for a client (it was something cool and benign but I can’t say what due to NDA) and the big papers people are referring to when they mention this all had either huge asterisks or huge methodological flaws.
i get asked about stuff like this from time to time and i always say "no, that's impossible" because i have ethics. The common retort is "well, i heard it was being used at <x>." and a client never contacting me again, which is fine.
Indeed, this same principle has been shown to work with sound waves and not just RF waves. There was a paper a few years back that used car speakers and the microphone to be able to detect the number of people in the car for the purpose of detecting children or pets left in hot vehicles.
Generally I think this is called "tomography" (https://en.m.wikipedia.org/wiki/Tomographic_reconstruction) i.e. the reconstruction of higher dimensional data from lower dimensional data. Your brain can do it automatically in a lot of cases. For example if you see the shadow of a rotating cube on the wall, your brain can reconstruct 3d information about the cube even though you only have access to a 2d projection
I use a usb cable and a Linux laptop to copy to a couple of external hard drives (which I store separately). It’s all manual but not too orrenous although i ought backup more often. The biggest hassle is accessing the new heic format on pretty much everything.
Could it all be made into a sd card image for a pi zero perhaps? Even with a web ui accessible over Wi-Fi? A basic cheap sync-cable-appliance that non-techies can easily use?
I think I heard that the latest 'rclone' now, finally, support iCloud ... but I think there is an issue there because you can't sync full quality / RAW photos to icloud, can you ?
https://www.howmanydayssinceajwtalgnonevuln.com/