TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Revealing the Inner Structure of AWS Session Tokens

51 pointsby ramimac10 months ago

6 comments

QuadmasterXLII10 months ago
Apparently medium has two seperate “do you want an account” popups now to click out of before you can read. This is a common problem once the development team for a website grows beyond a certain size- the left hand doesn’t know what the right hand is doing. Perhaps we can find the two project leads implementing them, have them fight to the death in some sort of saw trap, and the survivor gets to keep their javascript asking for my email address?
评论 #41088707 未加载
toomuchtodo10 months ago
<a href="https:&#x2F;&#x2F;archive.today&#x2F;2024.07.25-150149&#x2F;https:&#x2F;&#x2F;medium.com&#x2F;@TalBeerySec&#x2F;revealing-the-inner-structure-of-aws-session-tokens-a6c76469cba7" rel="nofollow">https:&#x2F;&#x2F;archive.today&#x2F;2024.07.25-150149&#x2F;https:&#x2F;&#x2F;medium.com&#x2F;@...</a>
165944709110 months ago
&gt; Following this revelation, we were able to observe that these keys change on an hourly basis...<p>Is it recommended to rotate keys hourly, or even daily? Or only for something like AWS - I&#x27;ve read&#x2F;been told monthly is more than adequate for reg. web apps
评论 #41091288 未加载
评论 #41088599 未加载
Scaevolus10 months ago
I&#x27;m skeptical of there being any security implications. Signed but not encrypted tokens are effectively plaintext metadata, and token revocation is still an important operation on the service side, preventing zombie token attacks.<p>Reading metadata can be useful to know when a token is expired without hitting a remote service.
Chris204810 months ago
Hmm, is this structure shared by all AWS-service session tokens? e.g. Amazon-Connect tokens etc.
Dachande66310 months ago
tl;dr it’s a standard protobuf payload after ignoring the first byte.