A Stolen Token Is Useless. A Stale One Still Works.

I closed the DPoP post in my Germany series with a line I still stand behind: Zero Trust is not a product you buy, it is a set of properties you can point at, and “a stolen token is useless” is one of the most important ones on the list. Michał Piszczek read that post and replied with an essay called Token Revocation Is Not an Endpoint, and it is the best response I have gotten to anything in that nine-post series. It is not a correction of my post so much as the next room in the same house — the room I walked past.