Viewing profile — geal

Biscuit maintainer here o/ There's definitelt some cool use cases we could collaborate on. One thing I'm looking at more deeply right now is tokens carrying the necessary data as t…

(biscuit author here) I tried a lot of different formats, especially looking for something that generated small tokens, that could have a canonical form, and that was supported in …

check if: if any one of those fails, the entire authorization fails allow if/deny if: they are tried in order, we stop at the first that matches. If an allow if matches and all che…

oh and for OAuth, it can integrate well with it: https://www.biscuitsec.org/blog/oauth-oidc/

(biscuit author here) you caught me, I can't help getting excited about the project XD > Given a long-term token, can I create short-term, auto-expiring tokens? yes, with attenuati…

(Biscuit author here) there is some support for revocation with the way revocation ids are implemented: there's one generated for each block of a token, so if you add the token's l…

there's a siimilar concept in Biscuit, the 3rd party block: https://www.biscuitsec.org/blog/third-party-blocks-why-how-w... It's not advertised a lot right now because it's not sup…

It is very much intended :D

No standardization for now, as we were still exploring the model. The spec is carefully built for evolution though, providing backwards compatibility where possible. The main devel…

This is not a cryptocurrency technology,it was designed with microservices authorization in mind, inspired from JWT and macaroons. I have looked at cryptocurrency related tech earl…

PASETO is great! It's way better than JWT, for the use cases targeted by JWT. Biscuit explores other use cases, like attenuation

Right, we forgot to add the context on this release, thank you for the feedback!

(biscuit author here) I like how that post points a crucial issue in authorization systems: how powerful and flexible should we make them? If you go towards flexibility, you get mo…

We in fact tested multiple languages. I can even point you to various works done at the ANSSI like https://github.com/ANSSI-FR/bootcode_parser (python) or https://github.com/ANSSI-…

(one of the authors here): parser generators are generally good for one thing: parsing programming languages. For more complex formats, where you have to carry state around, or bin…

thanks!

does it provide ordering and transcript verification, even in case of partition and resume? I know that XMPP is meant to handle that kind of stuff reliably, but a multiparty OTR or…