Filip Skokan @_panva

Identity, OpenID Connect, OAuth 2.0, SSO, Authorization, Authentication, Technical Standards. Node.js core collaborator and TSC member. github.com/panva Czech Republic Joined March 2019

Tweets

487
Followers

683
Following

129
Likes

84

Filip Skokan @_panva

2 months ago

@sindresorhus This is the way.

0 0 0 91 0

View Details

v24.x has a host of improvements I contributed that are not present on v22.x: - Post-Quantum Digital Signatures and Key Agreement/Encapsulation in node:crypto and Web Cryptography - (backport ready and pending) raw private/public/seed key gen and import formats

0 0 1 94 0

View Details

Filip Skokan @_panva

2 months ago

Did you move off of Node.js v20.x yet? There are only a couple weeks util its EOL. Save yourself the headache of scrambling to upgrade next year and jump straight to v24.x LTS

1 1 3 174 0

View Details

Node.js @nodejs

2 months ago

⚠️ Update: The Node.js project's security bug bounty program is being paused. Reporting remains unchanged, and so does our commitment to security. More details here: nodejs.org/en/blog/announ…

14 65 598 202K 107

View Details

Filip Skokan @_panva

2 months ago

The payload supports 3 ASCII characters. Messages like "Hi!", "lol", and "why" are covered. Longer messages are left as future work that SHOULD NOT be undertaken. panva.github.io/CS24/rfc-cs24.…

0 0 0 122 0

View Details

Filip Skokan @_panva

2 months ago

CS24 provides exactly 0 bits of security. The key is displayed on screen, believed to be the least secure key storage mechanism ever devised. The 24-bit key space is exhaustible in milliseconds, though "somewhat longer using CSS."

1 0 0 121 0

View Details

Filip Skokan @_panva

2 months ago

Introducing CWS, CSS Web Signatures. A security token scheme that runs entirely in the browser's style engine. No JavaScript. No WebAssembly. No server-side computation. Spec + interactive demo: panva.github.io/CS24

1 0 1 214 0

View Details

Filip Skokan @_panva

3 months ago

github.com/nodejs/node/pu…

0 0 0 64 0

View Details

Filip Skokan @_panva

3 months ago

yay or nay?

1 0 0 216 0

View Details

Filip Skokan @_panva

4 months ago

When it comes to JWTs issued for "yourself" the JWE format is far superior to JWS. Just let go of the HMAC JWS algorithms and use JWE direct encryption instead. You get confidentiality and it forces use of correct-length keys. await new jose.EncryptJWT > await new jose.SignJWT

0 0 3 260 2

View Details

Filip Skokan @_panva

7 months ago

Time to catch up with wicg.github.io/webcrypto-mode… @bunjavascript @deno_land @Cloudflare WPTs are available. Browsers started going through their implementations. These algorithms power HPKE implementations (github.com/panva/hpke)

0 0 2 252 0

View Details

Filip Skokan @_panva

7 months ago

@colinhacks A _button_? It gives so much more cli.github.com/manual/gh_work…

0 0 3 629 1

View Details

Filip Skokan @_panva

7 months ago

HPKE vector validation in *your* browser (and the implementation project's github actions pipeline) panva.github.io/hpke/

0 0 1 172 0

View Details

Filip Skokan @_panva

7 months ago

Let's get some ⭐⭐⭐ going 🙏 github.com/panva/hpke Hybrid Public Key Encryption (HPKE) for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes. Fully tree-shakeable. Fully typed. Extensible.