Aaron Parecki

Thursday, March 2, 2023

• 
• 

  11:32pm

  Asleep

  5:31am

  Awake

  5h 59m

  Slept

  22m

  Awake for

  

  Portland, Oregon, USA • 39°F

  Thu, Mar 2, 2023 5:31am -08:00
• The Great Gaslighting of the JavaScript Era | The Spicy Web (www.spicyweb.dev)

  Thu, Mar 2, 2023 6:30am -08:00 #web #react #javascript
• Brian O'Connor https://twitter.com/BrianFOConnor

  2) Write your brand's story
  
  This story is about the customer.
  
  Make them the hero, their problem is the "villain" and you are the guide who will give them a plan to overcome their pain.
  
  Here are the 7 steps you need to build your story:

  

  Portland, Oregon • 39°F

  Wed, Mar 1, 2023 1:35pm +00:00 (liked on Thu, Mar 2, 2023 7:54am -08:00)
• Charlotte Brandhorst-Satzkorn https://inuh.net/@catzkorn   •   Mar 2

  Ever wanted to use your own choice of OIDC IdP with @tailscale? I'm looking for private alpha testers - new and existing users welcome. DM me!
  

  I would love to check this out actually, I'm working on some documentation to help companies like Tailscale adopt features exactly like this!
  
  I don't have a way to DM you on mastodon but you can email me! https://aaronparecki.com/contact/

  Portland, Oregon • 39°F

  Thu, Mar 2, 2023 9:40am -08:00
• 

  another day, another account takeover caused by an open redirector and the OAuth Implicit flow 🫠
  
  https://salt.security/blog/traveling-with-oauth-account-takeover-on-booking-com

  Portland, Oregon • 40°F

  14 likes 4 reposts 1 reply

  Thu, Mar 2, 2023 10:16am -08:00 #oauth #security
• Brandon Trebitowski https://brandontreb.com   •   Mar 2

  Could using PKCE fix this issue?
  

  Yep! This is exactly the kind of thing PKCE prevents! With PKCE, even if the open redirect were in place, the attacker wouldn't have been able to do anything with the stolen authorization code.
  
  Although now I'm thinking this through and if the open redirects are really open enough, you could probably still pull something off even while using PKCE.

  Portland, Oregon • 42°F

  1 reply

  Thu, Mar 2, 2023 4:03pm -08:00
• Brandon Trebitowski https://brandontreb.com   •   Mar 3

  True, but it would be tricky.

  Wouldn’t the attacker have find a way to extract the code_verifier from local storage and pass it along with the hijacked redirect?

  They would have to somehow have the ability to write custom js code on the path they are redirecting to. I guess this is possible on sites that don’t sanitize user inputs.
  

  I was thinking the attacker makes up their *own* `code_verifier` and injects that into the first open redirect

  Portland, Oregon • 42°F

  1 reply

  Thu, Mar 2, 2023 4:16pm -08:00