webhamster

4 ms·

1.
by webhamster 6mo ago
German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitation to Google/Android is not great, we know that, a
2.
RFC9700: Best Current Practice for OAuth 2.0 Security(rfc-editor.org)
2 points by webhamster 2y ago|0 comments
3.
by webhamster 3y ago
For starters, without restrictions on the redirect URI, I (as the attacker) can just redirect a user to the authorization endpoint with a client ID of a trustworthy client, a redirect URI pointing to my server, and a PKCE challenge that I s
4.
by webhamster 3y ago
That's not correct. There are a number of attacks that can be mitigated by both, but PKCE serves as a very effective defense in case an authorization code leaks to an attacker. Such a leak can be caused by a malicious script on the red
5.
Selective Disclosure for JWTs (SD-JWT)(ietf.org)
2 points by webhamster 3y ago|0 comments
6.
Miqro: MQTT Micro-Services for Python(github.com)
3 points by webhamster 5y ago|0 comments
7.
Improving OAuth App-to-App Security(danielfett.de)
2 points by webhamster 6y ago|0 comments
8.
Finding and Fixing TLS Misconfigurations with TLS Profiler(danielfett.de)
2 points by webhamster 6y ago|0 comments
9.
OAuth and OpenID Connect: Do PKCE and Nonce Provide the Same Protection?(danielfett.de)
1 points by webhamster 6y ago|0 comments
10.
Show HN: TLS Profiler – Check your site's TLS against Mozilla's recommendations(tlsprofiler.danielfett.de)
2 points by webhamster 6y ago|0 comments
11.
by webhamster 7y ago
Can we finally stop conflating an encoding/signature/encryption method with a transport/storage mechanism?!
12.
by webhamster 7y ago
Quote: The resource owner password credentials grant MUST NOT be used. This grant type insecurely exposes the credentials of the resource owner to the client. Even if the client is benign, this results in an increased attack
13.
by webhamster 7y ago
FYI, the IETF plans to deprecate the Resource Owner Password Credentials Grant you are talking about [1]. [1] https://tools.ietf.org/html/draft-ietf-oauth-security-topics
14.
by webhamster 7y ago
There is no issuer in OAuth. Therefore, the distinct-redirect-URI solution is the most universal.
15.
by webhamster 7y ago
Also, we now have formal proofs for the security of the OAuth and OIDC protocols.
16.
by webhamster 7y ago
Does Hydra follow the OAuth Security BCP ( https://tools.ietf.org/html/draft-ietf-oauth-security-topics... )? I do not see PKCE or mix-up mitigation mentioned, for example.
17.
Why you should stop using the OAuth implicit grant(medium.com)
2 points by webhamster 8y ago|0 comments