STOP RECOMMENDING JWTS (WITH SYMMETRIC KEYS)

Summary from the TLDR InfoSec newsletter

The Truffle Security team analyzed 10k JWTs found via Shodan and another 500 committed to public repos in GitHub. They used hashcat to attempt cracking the JWTs and found that 1.2% of symmetric keys used in production were guessable within seconds. This was caused by users implementing weak passwords (including the defaults used in documentation and examples) as their symmetric keys when setting up their authentication systems.