Re:Building Facebook's Service Encryption Infastructure
by bdd on Wednesday May 29, 2019 @02:20PM
(#20043572)
We presented about CATs again in Def Con 26. It's a 21 minute talk but if you're interested in how CAT differ from Macaroons, you can skip to 16:15 mark where Yueting explains https://cryptovillage.org/cats-a-tale-of-scalable-authentica...
[ Parent
| on HN ]
Re:Building Facebook's Service Encryption Infastructure
by Boulth on Thursday May 30, 2019 @04:11PM
(#20055422)
I've seen both videos, nice explanation.
If you don't mind I wouldn't necessarily agree with the comment about JWT by Yueting. JWT is just a format, querying backend to get a new token is not necessary (this is only how people often use them). I actually built a small PoC that mints new JWTs on client side (in the browser) signing them with a non-exportable key (through Webcrypto).
As for Macaroons I believe they could also be adjusted to resemble CATs as I understood them (with layers for different services). I do have other issues with Macaroons though (https://news.ycombinator.com/item?id=17878845)...