Aaron Parecki

Yet another example of why SMS is terrible for 2fa and account recovery.

"the database — running on Amazon’s Elasticsearch — was configured with a Kibana front-end, making the data within easily readable"

https://techcrunch.com/2018/11/15/millions-sms-text-messages-leaked-two-factor-codes/

Alright, I think we can call it. Between @tlodderstedt's OAuth Security Best Practices and OAuth 2.0 for Browser Apps, the Implicit Flow is dead.

https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09

https://tools.ietf.org/html/draft-parecki-oauth-browser-based-apps-00

https://medium.com/@torsten_lodderstedt/why-you-should-stop-using-the-oauth-implicit-grant-2436ced1c926

I learned a lot about writing WordPress plugins making this! Kinda cool that you can completely take over the WordPress login screen like this too. https://developer.okta.com/blog/2018/10/30/wordpress-authentication-with-okta

Congrats @strava on some great looking #OAuth security updates to your API! https://developers.strava.com/docs/oauth-updates/

Next week I'll be hosting a workshop on @OAuth2 in Germany as part of Nürnberg Web Week festival @nueww! It's filling up fast but there are still some spots left! https://nuernberg.digital/festival/programm/2018/understanding-and-implementing-oauth-2-0-mit-aaron-parecki-42/

Had a great time giving a talk on @OAuth2 at @SCSU tonight! Thanks to all the students who braved the rain and came anyway! ☔️

If you missed my @devconf_us talk earlier this month, I just turned it into a blog post!
"Use @nginx to Add Authentication to Any Application" https://developer.okta.com/blog/2018/08/28/nginx-auth-request

On a plane to Boston! ✈️ I'll be giving a talk at @DevConf_us this weekend!

If you're in the area I'd love to meet up and talk about all things #oauth #indieweb and more!