Hacker News Reader

Fyi: This is an "internet draft". Anyone can write one and get it published with little to no review.

It’s also very hand-wavy. Can’t say I learned much from reading the whole document than just reading the title.

Exactly. Just like the deeply flawed JWT RFC when that was first introduced?

I'm not sure what your argument is. Are you implying that every internet draft eventually becomes an RFC?

> Are you implying that every internet draft eventually becomes an RFC?

No. I am saying even one of the worst designed specifications with tons of flaws and hype around it somehow made its way into being an RFC and still being used all over the internet for sessions [0] with many reasons why it is a critically flawed RFC. [1]

[0] https://apibakery.com/blog/no-jwt/

[1] https://paragonie.com/blog/2021/08/paseto-is-even-more-secur...

Reply on news.ycombinator.com