Re:End-to-End Encryption through Kafka
by staticassertion on Friday August 13, 2021 @05:09PM
(#28174561)
Ockam looks super cool. I've been thinking about trust in our networks and I think that there's a lot left on the table to be leveraged from these sorts of frameworks.
The old school method is "if it's in the network it's trusted". Obviously (in retrospect) this is terrible.
The new thing is Zero Trust, where you have point to point authentication. Ockam gives you this at an application layer, which is critical if your application serves APIs across trust boundaries (ie: "this API can be called by user group A, this one from B).
Further, Ockam also enables a sort of tunneled trust where you can have applications A, B, and C, and B can be untrusted, and A can communicate with C across B. This unlocks a bunch of things like encrypted delegation (C can know that B has been delegated permissions from A).
The old school method is "if it's in the network it's trusted". Obviously (in retrospect) this is terrible.
The new thing is Zero Trust, where you have point to point authentication. Ockam gives you this at an application layer, which is critical if your application serves APIs across trust boundaries (ie: "this API can be called by user group A, this one from B).
Further, Ockam also enables a sort of tunneled trust where you can have applications A, B, and C, and B can be untrusted, and A can communicate with C across B. This unlocks a bunch of things like encrypted delegation (C can know that B has been delegated permissions from A).
Really cool stuff. Excited to see it evolve.