4 ms·
The paper says that there are ways for users to find out their own access tokens and then "impersonate the app". That might be a valid threat model once the mac
by andor 8y ago
The paper says that there are ways for users to find out their own access tokens and then "impersonate the app". That might be a valid threat model once the machines take over, but for now my access token identifies me and not my app.
- plattegrond 8y agoIt's always fun when people try to design publicly accessible APIs that nevertheless aren't public. Unfortunately they keep finding ways to make it happen by force.
- kpil 8y agoThat makes sense in the bizarre backwards world where security implies security from the users.