Aaron Parecki

The @ietf "105attendees" mailing list is like a slow motion version of a Slack channel with way too many people in it. #ietf105

On my way to Montreal to talk about OAuth #ietf105! Crossing my fingers the connection at Newark goes well despite the impending thunderstorms.

I have some time free while I'm there this week, so if you're in the area and want to grab coffee let me know!

Some thoughts on adding identity to OAuth XYZ, a new draft spec to be discussed at #ietf105 next week.

If we're going to re-think OAuth from the ground up, we should build in support for common use cases.

https://aaronparecki.com/2019/07/18/17/adding-identity-to-xyz

Good reminder to add "check whether the password field supports pasting from password managers" to my list of criteria when deciding where to open a bank account. https://twitter.com/KeyBank_Help/status/1148247347463446528

Some great tips on developer experience from my friend @rod_laura!

📖 Publish open source
✍️ Communicate clearly
💻 Create lots of sample code
📝 Share on your blog
🌱 Build a community

https://developer.okta.com/blog/2019/06/10/five-essential-tips-for-building-developer-libraries

Last week I sat down with @nbarbettini to answer some questions about what's going on with the @OAuth_2 Implicit flow. #oauth 🎥➡ https://www.youtube.com/watch?v=CHzERullHe8

I had fun with this one: 7 Ways an OAuth Access Token is like a Hotel Key Card

https://developer.okta.com/blog/2019/06/05/seven-ways-an-oauth-access-token-is-like-a-hotel-key-card

Alright, if you are curious about "Sign In with Apple," I walk through exactly how it works and what it looks like in this post.

https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in-with-apple

#WWDC19 #OAuth #AppleID

Reading all these tweets of people freaking out about Apple requiring apps to use "Sign In with Apple" and feeling another "authentication is not authorization" rant coming. Lots of misunderstanding of sign-in vs accessing APIs. #WWDC19 #OAuth

Initial test of the "Sign in with Apple" API:

• It's more or less based on OAuth + OIDC
• Their documentation is missing a lot of key info to use it right now, I had to guess at a lot of things
• The `sub` claim includes some sort of unique user identifier, not an email

To anyone who thought partial redirect URL matching in @OAuth_2 is "good enough," read this thread. Complete Periscope account takeover just by viewing a tweet. https://hackerone.com/reports/110293 #oauth

If you're in Toronto you should come to my #OAuth talk tomorrow! 🔐 https://regionalevents.okta.com/oktaapiworkshoptoronto

We'll have food and drinks, and we're giving copies of my book to everyone who attends! 📚