Filip Skokan

Identity, OpenID Connect, OAuth 2.0, SSO, Authorization, Authentication, Technical Standards. Node.js core collaborator and TSC member.

[Filip Skokan @_panva]

Software's conformance to standards and its certification is not the pinnacle to shoot for. It is the absolute lowest bar.

[Filip Skokan @_panva]

@sindresorhus This is the way.

[Filip Skokan @_panva]

v24.x has a host of improvements I contributed that are not present on v22.x:
- Post-Quantum Digital Signatures and Key Agreement/Encapsulation in node:crypto and Web Cryptography
- (backport ready and pending) raw private/public/seed key gen and import formats

[Filip Skokan @_panva]

Did you move off of Node.js v20.x yet? There are only a couple weeks util its EOL. Save yourself the headache of scrambling to upgrade next year and jump straight to v24.x LTS

[Node.js @nodejs]

⚠️ Update: The Node.js project's security bug bounty program is being paused.

Reporting remains unchanged, and so does our commitment to security.

More details here: https://t.co/mSJQlPcpk4

[Filip Skokan @_panva]

The payload supports 3 ASCII characters. Messages like "Hi!", "lol", and "why" are covered. Longer messages are left as future work that SHOULD NOT be undertaken.

https://t.co/K90pUk65aU

[Filip Skokan @_panva]

Introducing CWS, CSS Web Signatures. A security token scheme that runs entirely in the browser's style engine. No JavaScript. No WebAssembly. No server-side computation.

Spec + interactive demo: https://t.co/GEhssDHDDC

[Filip Skokan @_panva]

CS24 provides exactly 0 bits of security. The key is displayed on screen, believed to be the least secure key storage mechanism ever devised. The 24-bit key space is exhaustible in milliseconds, though "somewhat longer using CSS."

[Filip Skokan @_panva]

https://t.co/yRNL02nOrX

[Filip Skokan @_panva]

yay or nay?

[Filip Skokan @_panva]

When it comes to JWTs issued for "yourself" the JWE format is far superior to JWS. Just let go of the HMAC JWS algorithms and use JWE direct encryption instead.

You get confidentiality and it forces use of correct-length keys.

await new jose.EncryptJWT > await new jose.SignJWT

[Filip Skokan @_panva]

Time to catch up with https://t.co/90OBYqUsrh @bunjavascript @deno_land @Cloudflare

WPTs are available. Browsers started going through their implementations.

These algorithms power HPKE implementations (https://t.co/obXVVZupQN)

[Filip Skokan @_panva]

@colinhacks A _button_? It gives so much more https://t.co/eDCWpwNsm2

[Filip Skokan @_panva]

HPKE vector validation in *your* browser (and the implementation project's github actions pipeline)

https://t.co/KUal2Urjlo

[Filip Skokan @_panva]

Let's get some ⭐⭐⭐ going 🙏
https://t.co/obXVVZtS1f

Hybrid Public Key Encryption (HPKE) for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes.

Fully tree-shakeable. Fully typed. Extensible.

[Filip Skokan @_panva]

I've been hammering on a new, 0 dependency, runtime-native-only crypto, module that runs everywhere*. Hard to Predict, Keeps everything Encrypted.

[Filip Skokan @_panva]

my new project's build script, tsc is then only used to emit declarations and a source map, the published files are index.(js, ts, d.ts(.map))

[Filip Skokan @_panva]

Only two more Hybrid PQ/T instances to go. Fully tree-shakeable. Fully typed. All crypto through WebCryptoAPI. All official vectors passing.

[Filip Skokan @_panva]

I've been hammering on a new, 0 dependency, runtime-native-only crypto, module that runs everywhere*. Hard to Predict, Keeps everything Encrypted.