12 ms·
I implemented publicly-verifiable macaroons as a PoC and found them reasonably ergonomic: https://github.com/ecordell/watchstander https://github.com/ecordell/w
by evancordell 8y ago
I implemented publicly-verifiable macaroons as a PoC and found them reasonably ergonomic: https://github.com/ecordell/watchstander https://github.com/ecordell/watchstander
(docs are sparse, I wrote an accompanying doc that might help: https://docs.google.com/document/d/1AU9bwpMYlnWBlwSIiwNyse0NiMaGuM-r4hZGYEsHFcA/edit?usp=sharing https://docs.google.com/document/d/1AU9bwpMYlnWBlwSIiwNyse0N...)
The basic idea is what you described: append only asymmetrically verifiable signatures.
As with most things Macaroons, the harder part is developing a caveat language and verifiers that actually meet your needs. And convincing people that they're a good idea.
- lvh 8y agoI think there are a few weird incompatibilities between libraries that are likely to bite you unless you have 1 library you use, but generally speaking: yes, figuring out how to structure your claims is the hard part. Most claims are really quite simple, which is why I’m bullish on most tiny startups just sticking a random token in a database and calling it a day.