3 ms·

These are implementation flaws, not flaws of the OAuth or OpenID Connect protocols themselves. But the prevalence of implementation flaws indicates a bigger pr

These are implementation flaws, not flaws of the OAuth or OpenID Connect protocols themselves. But the prevalence of implementation flaws indicates a bigger problem. We need better tools and libraries for app developers. Too many people are rolling their own ad hoc implementations, and they shouldn't have to do that. Some think the spec is partially to blame. The core spec is deceptively approachable, and implementers don't know how to respect it properly. And it's only a primitive building block. On its own it's often not enough to be useful. Even if you implement the core successfully, the glue around it might be bad. That's why I believe we need a bigger ecosystem of vetted utilities for every niche.

mSparks 10y ago
This isn't an "implimentation flaw". Its a fundamental flaw in the core logic. ->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim’s (this would be obtained from public information).
- ademarre 10y ago
  No, it is not a flaw in the OAuth core logic. From the paper's intro: > "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."
  - mSparks 10y ago
    How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic? An entry security product that doesnt define any security on entering... Pure Genius.
    - tecmobowlbo 10y ago
      I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.
      - mSparks 10y ago
        https://m.youtube.com/watch?v=zKuFu19LgZA https://m.youtube.com/watch?v=zKuFu19LgZA

mSparks 10y ago

This isn't an "implimentation flaw". Its a fundamental flaw in the core logic. ->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim’s (this would be obtained from public information).

ademarre 10y ago
No, it is not a flaw in the OAuth core logic. From the paper's intro: > "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."
- mSparks 10y ago
  How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic? An entry security product that doesnt define any security on entering... Pure Genius.
  - tecmobowlbo 10y ago
    I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.
    - mSparks 10y ago
      https://m.youtube.com/watch?v=zKuFu19LgZA https://m.youtube.com/watch?v=zKuFu19LgZA