4 ms·
This isn't an "implimentation flaw". Its a fundamental flaw in the core logic. ->the attacker would then sign in, via OAuth 2.0, with their own credentials. Th
by mSparks 10y ago
This isn't an "implimentation flaw". Its a fundamental flaw in the core logic.
->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim’s (this would be obtained from public information).
- ademarre 10y agoNo, it is not a flaw in the OAuth core logic. From the paper's intro: > "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."
- mSparks 10y agoHow does not defining the security protocols of your authentication protocol not count as a flaw in the core logic? An entry security product that doesnt define any security on entering... Pure Genius.
- tecmobowlbo 10y agoI believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.
- mSparks 10y agohttps://m.youtube.com/watch?v=zKuFu19LgZA https://m.youtube.com/watch?v=zKuFu19LgZA