nmgsd

You can't forge a JWT without stealing the private key of the valid JWT signer.

You can steal a JWT token the same way you can steal a session token.

The issue becomes very difficult when you need to preserve message history reliably and allow account usage across devices. Because key management becomes tricky and clunky and there's no easy UX ways around it.

For ephemeral messaging like a SnapChat type use case, you can EASILY provide p2p encrypted. For services like Telegram and FacebookMessenger, their feature list requires cross device syncing, historical archiving, and those features don't play well with rotating keys, perfect forward secrecy, and other e2e encrypted messaging techniques.

I agree strongly with you that the direction to be taken is independent messaging clients for existing messaging channels as long as those channels allow third party API use.

What channel would you use to share the keys on FB? The Facebook API simply will not let you do that anymore. Direct messages have a character limit and you can't just post to someone's wall anymore.

I tried working on something like this for seecret.io but was confounded by the Facebook API's limitations.

Twitter is much better for that. Probably other network too.

This highlights a major issue with ALL messaging apps, namely that the provider owns the clients AND the backend.

Distributed open-source clients that use end-2-end encryption over third party messaging channels is the future of secure messaging.

VPN people, VPN

It depends what the API is supposed to do of course.

A cool way to circumvent the keyword filtering: www.seecret.io

of course he does.

One option is to store the files in Amazon S3 and only serve them over cloudfront signed URLs. There's ways to lock down the S3 access so that only a few Very Important tech leadership folks can get to it.

You can always assume this.

From the article:"But take a closer look at that list and you can quickly see that all of these various behaviors could be described by one simple, everyday phrase: You're in trouble if your employee starts phoning it in."

This may be pretty obvious but it's not quite the terrible analysis of relying on just #4.

Are you perhaps thinking of JQuery UI? The core JQuery lib is still used. And for basic front end dev it really does offer most of the utility you'll look for in other libs.

1. Get and manipulate dom elements. 2. Register simple event handlers 3. Ajax calls that are simple (frankly all other ajax-ish APIs I've ever seen pretty much copy the design and approach of the JQuery one).

Also a pretty big ecosystem of simple highly focused add-ons. You (still) can get a long way with just JQuery