Identity, OpenID Connect, OAuth 2.0, SSO, Authorization, Authentication, Technical Standards. Node.js core collaborator and TSC member.
Czech Republic
Joined March 2019
- Tweets490
- Following129
- Followers706
- Likes85
Pinned Tweet
Software's conformance to standards and its certification is not the pinnacle to shoot for. It is the absolute lowest bar.
Filip Skokan retweeted
Security is a first-class topic at @nodeconfeu 2026. @_panva on post-quantum cryptography in Node.js, Zbyszek Tenerowicz on getting ahead of supply-chain attacks, Mikola Lysenko on deleting all CVEs. The conference we need right now in the @nodejs space.
This is possible on nightly now and the next 26.x release possibly tomorrow. Node.js loads OpenSSL STORE provider backed keys. In these examples a tiny KMS one i'm cooking up, in CI we're testing with pkcs11-provider.
The URL input being resolved with a STORE is what's new.
Filip Skokan retweeted
๐ฅ ๐๐ฉ๐๐๐ค๐๐ซ ๐๐ง๐ง๐จ๐ฎ๐ง๐๐๐ฆ๐๐ง๐ญ๐๏ธ
Thrilled to have @_panva on the NodeConf EU 2026 stage! He'll tell us the story of "๐๐จ๐ฌ๐ญ-๐๐ฎ๐๐ง๐ญ๐ฎ๐ฆ ๐๐ซ๐ฒ๐ฉ๐ญ๐จ๐ ๐ซ๐๐ฉ๐ก๐ฒ ๐ข๐ง ๐๐จ๐๐.๐ฃ๐ฌ".
๐๏ธDon't miss it out, secure your tickets nodeconf.eu
Did you move off of Node.js v20.x yet? There are only a couple weeks util its EOL. Save yourself the headache of scrambling to upgrade next year and jump straight to v24.x LTS
Filip Skokan retweeted
โ ๏ธ Update: The Node.js project's security bug bounty program is being paused.
Reporting remains unchanged, and so does our commitment to security.
More details here: nodejs.org/en/blog/announcemโฆ
Introducing CWS, CSS Web Signatures. A security token scheme that runs entirely in the browser's style engine. No JavaScript. No WebAssembly. No server-side computation.
Spec + interactive demo: panva.github.io/CS24
CS24 provides exactly 0 bits of security. The key is displayed on screen, believed to be the least secure key storage mechanism ever devised. The 24-bit key space is exhaustible in milliseconds, though "somewhat longer using CSS."
The payload supports 3 ASCII characters. Messages like "Hi!", "lol", and "why" are covered. Longer messages are left as future work that SHOULD NOT be undertaken.
panva.github.io/CS24/rfc-cs2โฆ
When it comes to JWTs issued for "yourself" the JWE format is far superior to JWS. Just let go of the HMAC JWS algorithms and use JWE direct encryption instead.
You get confidentiality and it forces use of correct-length keys.
await new jose.EncryptJWT > await new jose.SignJWT
Time to catch up with wicg.github.io/webcrypto-modโฆ @bunjavascript @deno_land @Cloudflare
WPTs are available. Browsers started going through their implementations.
These algorithms power HPKE implementations (github.com/panva/hpke)
HPKE vector validation in *your* browser (and the implementation project's github actions pipeline)
panva.github.io/hpke/
Let's get some โญโญโญ going ๐
github.com/panva/hpke
Hybrid Public Key Encryption (HPKE) for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes.
Fully tree-shakeable. Fully typed. Extensible.
my new project's build script, tsc is then only used to emit declarations and a source map, the published files are index.(js, ts, d.ts(.map))
I've been hammering on a new, 0 dependency, runtime-native-only crypto, module that runs everywhere*. Hard to Predict, Keeps everything Encrypted.
