3 ms·
an analogy i like is that if encryption is a locked box you're passing around, using a token is like passing around a safe deposit box key instead- the real sec
by smegsicle 5y ago
an analogy i like is that if encryption is a locked box you're passing around, using a token is like passing around a safe deposit box key instead- the real secret is still secure at the bank, probably encrypted as if by a teller's key (not with your token-"key", which is not an encryption key, just a reference to the box, and you can make as many tokens to the same box as you want.. so that's a rough edge to the analogy)
but anyway, it's just passing references around, so i think the main reason it gets confusing is because it's discussed as an alternative to encryption, despite being kind of the opposite of encryption (passing around a token and protecting the vault, vs passing around ciphertext and protecting the key)
- jamesarmstead 5y agoBingo! The underlying value is stored safely away from the systems passing around the reference - this makes it simpler and safer for the underlying systems to use the plaintext vs needing to share the private key with each system needing to touch the data!
- drewcoo 5y agoI thought they were talking about something more like canonicalizing and hashing the data.
- smegsicle 5y agogenerally tokens are arbitrary codes without any mathematical relationship to the data, so that a token being leaked doesn't reveal anything about the secret (you might want to invalidate leaked tokens tho)