4 ms·
The first case sounds more like a case for OAuth which doesn't have to use JWTs or digital signatures. > I don't really want Google or Apple or whoever has, fo
by EthanHeilman 2y ago
The first case sounds more like a case for OAuth which doesn't have to use JWTs or digital signatures.
> I don't really want Google or Apple or whoever has, for idiosyncratic reasons, possession of a private key, to sign every request I make to Google Calendar, because they will inevitably revoke it sooner for obnoxious business reasons than any good security reason.
Can you provide more context on this? I would assume asymmetric signing keys are less likely to be revoked than say an HMAC key since an HMAC key must be securely stored at both the client and server whereas you can just put a asymmetric signing key in an HSM at the client and be done with it.
- radicalbyte 2y agoWhich we have in modern computers and mobiles (the EU identity wallet concept is built around them).
- EthanHeilman 2y agoI thought the EU wallet was using JWTs that attest to public key. You don't use them as bearer tokens, you use them as certificates and then do verifiable credential presentation via proof of possession and SD-JWTs.