4 ms·

I'm impressed that you put your money where your mouth is and built & marketed an alternative: https://paseto.io/ https://paseto.io/ Anyone here got experience

I'm impressed that you put your money where your mouth is and built & marketed an alternative: https://paseto.io/ https://paseto.io/ Anyone here got experience using Paseto in anger? (besides CiPHPerCoder who made it) I would love a JWT-like thing that's equally common yet better designed. But especially when using it in public APIs and the likes, acceptance has to be pretty broad. Anyone got insights as to how mainstream Paseto is getting?

CiPHPerCoder 7y ago
> Anyone got insights as to how mainstream Paseto is getting? Okta's a pretty big name in authn/authz and their engineers recently published an open source PASETO implementation. https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-paseto https://developer.okta.com/blog/2019/10/17/a-thorough-introd... https://github.com/paseto-toolkit/jpaseto https://github.com/paseto-toolkit/jpaseto
jillesvangurp 7y ago
Judging from the number of stars of the various git repositories for different languages, there are a few people using it but not a whole lot. The most popular implementation seems to be php based. That suggest to me it's still early days for this. E.g. the Java implementation only has 13 stars, which is not a lot. Also it has a native dependency, which is not ideal. E.g. JWT has a pure Java implementation from oauth0. JWT has been out there for a few years and there are many uses of it that are fine. I've used it in the past and it was easy set up and get started with. The main criticism seems to be that users have too much wiggle room to do silly things like using alg=noneor that certain widely used algorithm combinations have some weaknesses. I guess that's valid but not a huge concern if you know what you are doing. Paseto looks like it improves by narrowing down the choices to some sane choices, which is a valid approach. Of course IETF could update the relevant RFCs to use the same algorithms for JWT at some point.
- anonsivalley652 7y ago
  Popularity != value. Get over false signals.
  - Aeolun 7y ago
    As soon as AWS supports PASETO we can talk, until that time popularity equals value.
    - CiPHPerCoder 7y ago
      Give me a few months, then. :P If they agree it's a good idea, it should pick up quickly.
      - anonsivalley652 7y ago
        Don't count on it. As it happens, I used to be a AWS consultant w/ a third-party preferred vendor. Their product direction involves more politics, job security and creating a labyrinthian platform that's difficult to emulate precisely.
        deleted 7y ago
        [deleted]
      - scarmig 7y ago
        Rooting for you! It's a good idea, and successfully popularizing it would provide a huge amount of value to the world.
    - anonsivalley652 7y ago
      No, I was speaking even more generally. There are thousands of mainframes still running COBOL that process trillions/billions of dollars of transactions per day. There are obscure software packages and programming languages you've never heard of doing many important, niche tasks. So no, popularity will never equal value. There is no wisdom in a mob. The. End.

CiPHPerCoder 7y ago

> Anyone got insights as to how mainstream Paseto is getting? Okta's a pretty big name in authn/authz and their engineers recently published an open source PASETO implementation. https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-paseto https://developer.okta.com/blog/2019/10/17/a-thorough-introd... https://github.com/paseto-toolkit/jpaseto https://github.com/paseto-toolkit/jpaseto

jillesvangurp 7y ago

Judging from the number of stars of the various git repositories for different languages, there are a few people using it but not a whole lot. The most popular implementation seems to be php based. That suggest to me it's still early days for this. E.g. the Java implementation only has 13 stars, which is not a lot. Also it has a native dependency, which is not ideal. E.g. JWT has a pure Java implementation from oauth0. JWT has been out there for a few years and there are many uses of it that are fine. I've used it in the past and it was easy set up and get started with. The main criticism seems to be that users have too much wiggle room to do silly things like using alg=noneor that certain widely used algorithm combinations have some weaknesses. I guess that's valid but not a huge concern if you know what you are doing. Paseto looks like it improves by narrowing down the choices to some sane choices, which is a valid approach. Of course IETF could update the relevant RFCs to use the same algorithms for JWT at some point.

anonsivalley652 7y ago
Popularity != value. Get over false signals.
- Aeolun 7y ago
  As soon as AWS supports PASETO we can talk, until that time popularity equals value.
  - CiPHPerCoder 7y ago
    Give me a few months, then. :P If they agree it's a good idea, it should pick up quickly.
    - anonsivalley652 7y ago
      Don't count on it. As it happens, I used to be a AWS consultant w/ a third-party preferred vendor. Their product direction involves more politics, job security and creating a labyrinthian platform that's difficult to emulate precisely.
      - deleted 7y ago
        [deleted]
    - scarmig 7y ago
      Rooting for you! It's a good idea, and successfully popularizing it would provide a huge amount of value to the world.
  - anonsivalley652 7y ago
    No, I was speaking even more generally. There are thousands of mainframes still running COBOL that process trillions/billions of dollars of transactions per day. There are obscure software packages and programming languages you've never heard of doing many important, niche tasks. So no, popularity will never equal value. There is no wisdom in a mob. The. End.