Tptacek shits on them every time it comes up. Unfortunately I can never quite co...

icebraining · on Dec 27, 2018

He suggests KISS: you can probably get away with plain old server-side auth, and if you really need client-side tokens, use something simple that just encrypts and signs them: https://news.ycombinator.com/item?id=13612941#13615634

Aeolun · on Dec 27, 2018

> Something simple that just encrypts and signs them

Like JWT?

I feel like that argument goes around in circles.

icebraining · on Dec 27, 2018

tptacek's point is that JWT is not simple at all:

https://news.ycombinator.com/item?id=13866983

https://news.ycombinator.com/item?id=14292223

geezerjay · on Dec 27, 2018

> I feel like that argument goes around in circles.

I feel that the problem is that some users are talking about stuff they know nothing about, but still feel compelled to be very vocal and opinionated.