Aaron Parecki

The video from my @OReillySACon talk is up! "OAuth: When Things Go Wrong" https://www.youtube.com/watch?v=H6MxsFMAoP8

I mentioned in my #OAuth talk last week that I was working on a blog post describing how to add the Device Flow to any OAuth server, and I just finished the post! \o/ 🔐 https://developer.okta.com/blog/2019/02/19/add-oauth-device-flow-to-any-server

always fun to google the random strings I make up for my OAuth examples and see who else's API docs and tutorials they end up in: https://www.google.com/search?q=RsT5OjbzRn430zqMLgV3Ia

I just posted the slides from my #OReillySACon talk last week!

OAuth: When Things Go Wrong

https://speakerdeck.com/aaronpk/oauth-when-things-go-wrong

If you've ever needed a link to send someone to explain why OAuth secrets aren't safe in mobile apps, I made you a thing: https://developer.okta.com/blog/2019/01/22/oauth-api-keys-arent-safe-in-mobile-apps

A pretty good step-by-step walkthrough of the @oauth2 PKCE flow by @afitnerd https://developer.okta.com/blog/2018/12/13/oauth-2-for-native-and-mobile-apps

and yes it's pronounced "pixie"

Take 3 minutes to learn how OAuth access tokens are like a hotel keycard! 🔐💳
https://www.youtube.com/watch?v=BNEoKexlmA4 (Filmed last week at my hotel!)

Yet another example of why SMS is terrible for 2fa and account recovery.

"the database — running on Amazon’s Elasticsearch — was configured with a Kibana front-end, making the data within easily readable"

https://techcrunch.com/2018/11/15/millions-sms-text-messages-leaked-two-factor-codes/

Alright, I think we can call it. Between @tlodderstedt's OAuth Security Best Practices and OAuth 2.0 for Browser Apps, the Implicit Flow is dead.

https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09

https://tools.ietf.org/html/draft-parecki-oauth-browser-based-apps-00

https://medium.com/@torsten_lodderstedt/why-you-should-stop-using-the-oauth-implicit-grant-2436ced1c926

I learned a lot about writing WordPress plugins making this! Kinda cool that you can completely take over the WordPress login screen like this too. https://developer.okta.com/blog/2018/10/30/wordpress-authentication-with-okta

Congrats @strava on some great looking #OAuth security updates to your API! https://developers.strava.com/docs/oauth-updates/

Next week I'll be hosting a workshop on @OAuth2 in Germany as part of Nürnberg Web Week festival @nueww! It's filling up fast but there are still some spots left! https://nuernberg.digital/festival/programm/2018/understanding-and-implementing-oauth-2-0-mit-aaron-parecki-42/

Had a great time giving a talk on @OAuth2 at @SCSU tonight! Thanks to all the students who braved the rain and came anyway! ☔️