3 ms·
This[0] paper argues that "OAuth 2.0 is intrinsically vulnerable to App impersonation attack due to its provision of multiple authorization flows and token type
by gspetr 8y ago
This[0] paper argues that "OAuth 2.0 is intrinsically vulnerable to App impersonation attack due to its provision of multiple authorization flows and token types."
[0] Application Impersonation: Problems of OAuth and API
Design in Online Social Networks
http://cosn.acm.org/2014/files/cosn018s-huA.pdf http://cosn.acm.org/2014/files/cosn018s-huA.pdf
- andor 8y agoThe paper says that there are ways for users to find out their own access tokens and then "impersonate the app". That might be a valid threat model once the machines take over, but for now my access token identifies me and not my app.
- plattegrond 8y agoIt's always fun when people try to design publicly accessible APIs that nevertheless aren't public. Unfortunately they keep finding ways to make it happen by force.
- kpil 8y agoThat makes sense in the bizarre backwards world where security implies security from the users.