Hacker News new | ask | show | jobs
by Cheezmeister 846 days ago
> A session token has such limited power compared to secret key

Does it though? Sure, it has different threat models, and you may choose to assign it different trust levels, but fundamentally (as I understand it) every session token _is_ a secret key, with added benefits.