63°F

Aaron Parecki

  • Articles
  • Notes
  • Photos
  • Eugen https://mastodon.social/@Gargron

    The thing to remember is that at some point in recent past nobody knew what e-mail was and people had to learn about. And before that personal computers were new and folks had to learn how to use them.

    Not everything can be reduced to what you already know! Mastodon requires a tiny bit of extra knowledge because it differs from other social media platforms.

    Portland, Oregon • 82°F
    Wed, Aug 8, 2018 7:39pm +00:00 (liked on Wed, Aug 8, 2018 12:41pm -07:00)
  • Darius Kazemi https://social.tinysubversions.com/@darius

    Here's an article about fun bot makers leaving Twitter. Both @aparrish and I are interested in it. https://slate.com/technology/2018/08/twitters-new-developer-guidelines-might-end-fun-bot-accounts.html

    Portland, Oregon • 82°F
    Wed, Aug 8, 2018 7:33pm +00:00 (liked on Wed, Aug 8, 2018 12:35pm -07:00)
  • Pelle Wessman http://voxpelli.com
    The IndieWeb currently also breaks apart the different areas of responsibility in a way that I so far haven’t seen Mastodon do. In the IndieWeb you can have one application for posting content, one for hosting your content and presenting it to the world, a third to read posts etc
    Portland, Oregon • 82°F
    Wed, Aug 8, 2018 6:35pm +00:00 (liked on Wed, Aug 8, 2018 12:22pm -07:00)
  • Andy Baio https://xoxo.zone/@andybaio   •   Aug 8

    Is there any way to post a message SOLELY to your local timeline? That would be pretty cool.

    Aaron Parecki
    I was actually just thinking the same thing but addressing a specific server. I wanted to say hi to all the xoxo.zone people but my account is on my own website!
    Portland, Oregon, USA • 82°F
    Wed, Aug 8, 2018 12:15pm -07:00
  • Andy Baio https://xoxo.zone/@andybaio

    The indieweb is looking better and better every day.

    Portland, Oregon • 82°F
    Wed, Aug 8, 2018 6:07pm +00:00 (liked on Wed, Aug 8, 2018 12:13pm -07:00)
  • Andy McIlwain https://andymci.com
    Shoutout to @indiewebcamp #indieweb from @jeckman. Smaller communities like this pushing for an open web. They need help bridging the gap w/ non-technical users. #wcpub
    Portland, Oregon • 75°F
    Wed, Aug 8, 2018 4:52pm +00:00 (liked on Wed, Aug 8, 2018 9:55am -07:00) #indieweb #wcpub
  • Khor https://twitter.com/neth_6   •   Aug 8
    The link you shared is for Implicit? Implicit does not use client secret. Does this mean IndieAuth is more similar to Implicit than Auth Code but is more secure as the client id has to be redirect uri?
    Aaron Parecki
    Regular OAuth 2.0 also supports the Authorization Code flow with no secret. In fact, many companies recommend Auth Code w/no secret instead of Implicit.

    IndieAuth is like taking Auth Code w/no secret and adding back some layers of security because of the client ID being a URL.
    Portland, Oregon, USA • 64°F
    1 like 1 reply
    Wed, Aug 8, 2018 7:42am -07:00
  • Khor https://twitter.com/neth_6   •   Aug 8
    Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
    Aaron Parecki
    But, most importantly, the fact that IndieAuth uses a URL for the client ID means that you *do* authenticate the client in the initial Auth Code request, since the redirect URL has to match the domain or be registered. That's an improvement over OAuth with no secret.
    Portland, Oregon, USA • 64°F
    1 like 1 reply
    Wed, Aug 8, 2018 6:28am -07:00
  • Khor https://twitter.com/neth_6   •   Aug 8
    Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
    Aaron Parecki
    Without the secret, there is no authentication of the client. PKCE solves this by using essentially an on-the-fly secret safe for use by mobile apps. IndieAuth *could* adopt the PKCE extension as well, tho afaik noone has done that yet.
    Portland, Oregon, USA • 64°F
    Wed, Aug 8, 2018 6:26am -07:00
  • Khor https://twitter.com/neth_6   •   Aug 8
    Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
    Aaron Parecki
    Good question! The OAuth Authorization Code flow doesn't require a secret either. For example mobile apps can't use a secret, but still use the Auth Code flow. There are many benefits to the Auth Code flow over Implicit, I wrote some about that here https://developer.okta.com/blog/2018/05/24/what-is-the-oauth2-implicit-grant-type#when-to-use-the-implicit-grant-type
    Portland, Oregon, USA • 64°F
    3 replies
    Wed, Aug 8, 2018 6:25am -07:00
  • 9:54pm
    Asleep
    5:04am
    Awake
    7h 10m
    Slept
    13m
    Awake for
    Portland, Oregon, USA
    Wed, Aug 8, 2018 5:04am -07:00
  • Bluecherry - For all your digital security needs - Bluecherry (www.bluecherrydvr.com)
    Tue, Aug 7, 2018 8:02pm -07:00 #cctv
  • ZoneMinder - Home (zoneminder.com)
    Tue, Aug 7, 2018 8:02pm -07:00 #cctv
  • Kerberos.io - free and cheap motion detection video surveillance security system (www.kerberos.io)
    Tue, Aug 7, 2018 8:02pm -07:00 #cctv
  • Shinobi - Simple CCTV and NVR Solution - Home (shinobi.video)
    Tue, Aug 7, 2018 8:01pm -07:00 #cctv #security
  • Securing Web Sites Made Them Less Accessible – Eric’s Archived Thoughts (meyerweb.com)
    Tue, Aug 7, 2018 4:01pm -07:00 #https #security #web
  • Ride
    2.01mi
    Distance
    13:40
    Duration
    3:19pm
    Start
    3:33pm
    End
    Portland, Oregon • 90°F
    Tue, Aug 7, 2018 3:33pm -07:00
  • Ride
    1.03mi
    Distance
    6:14
    Duration
    1:49pm
    Start
    1:55pm
    End
    Portland, Oregon • 87°F
    Tue, Aug 7, 2018 1:55pm -07:00
  • Aaron Parecki
    at Apple Pioneer Place
    Portland, Oregon • Tue, August 7, 2018 1:03pm
    45.517846 -122.677485
    🤒⌨️ getting my keyboard replaced
    Portland, OR, United States • 85°F
    2 replies 51 Coins
    Tue, Aug 7, 2018 1:03pm -07:00
  • Typey type | Lessons (didoesdigital.com)
    Tue, Aug 7, 2018 7:23am -07:00 #steno
older

Hi, I'm Aaron Parecki, Director of Identity Standards at Okta, and co-founder of IndieWebCamp. I maintain oauth.net, write and consult about OAuth, and participate in the OAuth Working Group at the IETF. I also help people learn about video production and livestreaming. (detailed bio)

I've been tracking my location since 2008 and I wrote 100 songs in 100 days. I've spoken at conferences around the world about owning your data, OAuth, quantified self, and explained why R is a vowel. Read more.

  • Director of Identity Standards at Okta
  • IndieWebCamp Founder
  • OAuth WG Editor
  • OpenID Board Member

  • 🎥 YouTube Tutorials and Reviews
  • 🏠 We're building a triplex!
  • ⭐️ Life Stack
  • ⚙️ Home Automation
  • All
  • Articles
  • Bookmarks
  • Notes
  • Photos
  • Replies
  • Reviews
  • Trips
  • Videos
  • Contact
© 1999-2025 by Aaron Parecki. Powered by p3k. This site supports Webmention.
Except where otherwise noted, text content on this site is licensed under a Creative Commons Attribution 3.0 License.
IndieWebCamp Microformats Webmention W3C HTML5 Creative Commons
WeChat ID
aaronpk_tv