WeChat ID
aaronpk_tv
Thursday, October 7, 2021
| bicycle |
38 min
|
|
7.4 miles
|
bicycle |
-
-
Roberto Blake 🇺🇸🇵🇦🗽Creative Entrepreneur
https://twitter.com/robertoblake
•
Oct 7
For those who have renovated a basement for YouTube or streaming, about how much was the total project?
I do not want to add it all up -
Authorization codes eXXXposed! Check out these naughty native apps going PKCE-free in public! https://tinyurl.com/4ht58kst
-
Look who is back in the family: @aaronpk ! With a great talk about #OAuth. Say hello to Aaron and see the details about him and his talk here: https://beyondtellerrand.com/events/dusseldorf-2021/speakers/aaron-parecki
-
-
The OAuth happy hour with @aaronpk starts in 4 minutes! Who knows, we might even get to chat about the Explicit Flow :P
https://youtu.be/B3a3-JV-dl0 -
@goto
https://twitter.com/samuelgoto
•
Oct 7
@aaronpk on a related note: does any part of IndieAuth break when browsers block third party cookies?
No, none of it relies on third party cookies thankfully, it's closer to plain OAuth in that sense. -
@goto
https://twitter.com/samuelgoto
•
Oct 7
Ok, I did look into this more carefully and I remember running into this earlier.
How does this relate to OIDC? Is it fair to characterize it as an alternative to it that operates on the same level/layer (e.g. both are extensions to oauth?)?
There are definitely some similarities since they are both adding an identity layer on top of OAuth. IndieAuth is a much smaller surface area tho and does less stuff. Some more details here: https://indieweb.org/How_is_IndieAuth_different_from_OpenID_Connect -
@goto
https://twitter.com/samuelgoto
•
Oct 8
"Because these URLs rely on the public web and DNS, they are guaranteed to be globally unique." -- ugh, is this a feature or a bug? I feel like this isn't going to age well :(
Do you mean when there's a viable replacement for DNS? We can cross that bridge when we come to it.
-
@goto
https://twitter.com/samuelgoto
•
Oct 8
No, in the sense are these designed such that two different RPs get the same global identifier for the same user?
Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.
-
Aaron Parecki
https://aaronparecki.com/
•
Oct 7
Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.
I'm actually really interested in this particular problem right now since Sign In with Apple is probably the biggest example of differing IDs per RP yet the first thing the RPs want to do is resolve that back to an identifiable user. -
I actually thought I had already joined, but I haven't yet actually joined a meeting. It's a lot to keep up on with all the other spec work I'm in the middle of 😅
-
@goto
https://twitter.com/samuelgoto
•
Oct 8
LMK if you run into a good formulation.
FWIW email may be a good analogy and source of inspiration. In browser land, SHA256(user + RP)@idp.example does the trick.
Relying on sha256 as the end of the story seems like a thing that also won't age well. It's only a matter of time until we see sha256 the way we see md5 today. -
@goto
https://twitter.com/samuelgoto
•
Oct 8
Sure. I'm sure one could find a hashing function that would age well (I'm making an assumption :) but a lot of stuff breaks if one doesn't :)).
But there's a big difference in relying on a specific hash function for something that won't matter a day from now (validating an ID token) vs something that can be correlated years later (hashed identifiers in logs)
-
@goto
https://twitter.com/samuelgoto
•
Oct 8
Ah that's indeed a reasonable distinction. Still seems like solvable? Like Signal that uses a master identifier and then ephemeral (yet stable) ones?
Maybe, but at the end of the day I would assume any crypto will eventually be broken, so it's a game of picking good enough algorithms to avoid correlation in a timeframe that would be a problem.
