Auth and Distributed Systems: Don't Throw the Baby Out with the Bathwater
summary
Compares centralized authorization with fully distributed token-based models and argues that immediate revocation (day-zero) is essential; recommends key rotation and short-lived access tokens combined with refresh tokens to limit blast radius. Presents Biscuit, a protobuf-based token specification with a Rust reference implementation, a JavaScript WASM demo, CLI and editor integrations, and production usage at Clever Cloud and experiments at SpaceX; Biscuit implements attenuated bearer tokens so services can locally reduce privileges per hop, with a live browser demo showing attenuation.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:31Distributed systems why
- 8:48Token management revocation
- 15:27Key rotation issues
- 22:12Biscuits demo
- 28:29Distributed auth patterns
- 39:10Biscuits ecosystem tools
- 43:07Q&A
related talks
36mAuth and Distributed Systems: Don’t Throw the Baby Out with the Bathwater of Auth
31mAuthentication/Authorization Starters Battle
22mToken-Based Architecture Design
01h 06mMicroservice Authentication and Authorization
38mAuthentication as a Microservice: Portable Customer Identity Management
14mAPI access control strategies beyond JWT bearer tokens
46mBearer of Good News
19mSecuring Agents with Open Standards