richzw

Chat GPT "DAN" (and other "Jailbreaks")

Stop using JWTs!

TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.

If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)

A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/

The reason to avoid JWTs comes down to a couple different points:

The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions

	//a binary tree, each node is positive or negative integer, how to find a sub-tree, all the nodes sum is largest.

	#include <iostream>
	#include <limits>

	using namespace std;

	struct Node {
	long data;
	Node *lchild;

	#include <algorithm>
	#include <fstream>
	#include <iostream>
	#include <string>
	#include <vector>

	using namespace std;

	bool covered(const vector<string>& filters, const string& line)
	{

	int
	binary_search_first_position(int *A, int n, int target) {
	int end[2] = { -1, n };
	while (end[0] + 1 < end[1]) {
	int mid = (end[0] + end[1]) / 2;
	int sign = (unsigned)(A[mid] - target) >> 31;
	end[1-sign] = mid;
	}
	int high = end[1];
	if (high >= n \|\| A[high] != target)

	# EDIT: 2013/10/20
	# google has updated its kwt UI, this script doesn't work any more!
	# may be I will update this script when I have time to investigate their new Interface.

	from selenium import webdriver
	from selenium.common.exceptions import TimeoutException
	import selenium.webdriver.support.wait
	selenium.webdriver.support.wait.POLL_FREQUENCY = 0.05

	import re

	// EDIT: 2013/10/20
	// google has updated its kwt UI, this script doesn't work any more!
	// may be I will update this script when I have time to investigate their new Interface.


	// requires
	var utils = require('utils');
	var casper = require('casper').create()
	var casper = require('casper').create({
	verbose: true,

	#!/usr/bin/env python2
	"""
	Author: takeshix <takeshix@adversec.com>
	PoC code for CVE-2014-0160. Original PoC by Jared Stafford (jspenguin@jspenguin.org).

	Supportes all versions of TLS and has STARTTLS support for SMTP,POP3,IMAP,FTP and XMPP.
	"""

	import sys,struct,socket
	from argparse import ArgumentParser

	# /// script
	# dependencies = [
	# "datasets>=3.0.0",
	# "peft>=0.13.0",
	# "torch",
	# "transformers",
	# "trl>=1.5.0",
	# ]
	# ///