Aaron Parecki

@aaronpk This could save you 4 characters ;))
return btoa(encodeURIComponent(str)
.replace(/%([0-9A-F]{2})/g, (m, p1) => String.fromCharCode(parseInt(('0x'+p1), 16))));

@aaronpk sure, but a malicious browser could also save the entire js state to disk in exactly the same way (and some do a limited version of this for caching purposes). so it's hard for me to think of that as a security benefit? this is only more secure if everyone along the line behaves exactly in the way you expect it to

@aaronpk but the browser is also the one executing the code that's verifying whether the browser transferred the data correctly? maybe a concrete attack would help me get my head around this better

@aaronpk but the browser is also the one executing the code that's verifying whether the browser transferred the data correctly? maybe a concrete attack would help me get my head around this better

@aaronpk sorry I guess I should have specified "with https". doesn't https' security model encompass this one?

@aaronpk This is a good post! But I'm having trouble trying to understand the attack that the authorization flow is protecting against. How can a token be stolen "in transit back to the application"?

@aaronpk This is a good post! But I'm having trouble trying to understand the attack that the authorization flow is protecting against. How can a token be stolen "in transit back to the application"?

@aaronpk This is a good post! But I'm having trouble trying to understand the attack that the authorization flow is protecting against. How can a token be stolen "in transit back to the application"?

About Luminary’s $100 million: many of us are working 7 days a week on a tiny budget to build something we think is important, and Luminary and the like will light VC checks on fire to burn the podcast industry down around them if it means the chance to monetize an open platform.

whew, just added 3 more posts in an attempt to catch up on my 365 RFCs project

https://write.as/365-rfcs/rfc-77
https://write.as/365-rfcs/rfc-78
https://write.as/365-rfcs/rfc-79

I am currently... 35 days behind. Oof.

Jetblue is rolling out a procedure where they identify customers not by their boarding pass or passport, but by facial recognition provided by the Department of Homeland Security https://twitter.com/mackenzief/status/1118509708673998848 http://mediaroom.jetblue.com/investor-relations/press-releases/2018/11-15-2018-184045420

Makes me feel sick to my stomach. I should stop flying places.

@aaronpk > that feeling when when

I regret to inform you that you appear to be showing symptoms of RAS Syndrome.

@aaronpk read the summary, probably not for me. However, hats off for clearly starting the audience. Many authors, businesses, schools, etc. would be much better off doing so. I'm basically the opposite of the audience, except I haven't put up the picket fence yet.