3 ms·
Perhaps Apple has intentionally NOT jumped on the OpenID effort without tweaks, for the following reason? Quoting wikipedia for convenience: "OAuth 2.0 has ha
by jjtheblunt 7y ago
Perhaps Apple has intentionally NOT jumped on the OpenID effort without tweaks, for the following reason?
Quoting wikipedia for convenience:
"OAuth 2.0 has had numerous security flaws exposed in implementations.[17] The protocol itself has been described as inherently insecure by security experts and a primary contributor to the specification stated that implementation mistakes are almost inevitable.[18][19]".
- jogux 7y agoApple are using OAuth 2.0. The contributor referred to (John Bradley) as saying that OAuth 2.0 implementation mistakes are almost inevitable is one of the authors of the OpenID Connect spec, and if you follow the citation link ( https://mailarchive.ietf.org/arch/msg/oauth/WuT1tmFoxs8S_2v7kYmouF_ZVFo https://mailarchive.ietf.org/arch/msg/oauth/WuT1tmFoxs8S_2v7... ) you'll see him mention that the flaw referred to is fixed in OpenID Connect.