Very consistent with what tptacek has been advocating for on news.yc over the years. The authn mechanism we use is closer to Keybase's NIST (non-interactive se

Very consistent with what tptacek has been advocating for on news.yc over the years. The authn mechanism we use is closer to Keybase's NIST (non-interactive session tokens)[0] that are a mix of AWS-style Bearer Tokens and the usual Random Tokens. Of course, the problems around "logistics" (public-key cryptography)[1] are a real nightmare as the post points out. We exchange these tokens between devices (if needed) over password-authenticated channels (using CPACE [2]). [0] https://keybase.io/docs/api/1.0/nist https://keybase.io/docs/api/1.0/nist [1] As examples, see what goes on when a Keybase user associates a new device: https://book.keybase.io/docs/crypto/key-exchange https://book.keybase.io/docs/crypto/key-exchange or when SQRL user revokes compromised keys: https://www.grc.com/sqrl/idlock.htm https://www.grc.com/sqrl/idlock.htm [2] https://github.com/jedisct1/cpace https://github.com/jedisct1/cpace