WeChat ID
aaronpk_tv
-
Peter Holz
https://twitter.com/nu4ur
•
Nov 26
Thanks! Rotation doesn't help against the theft itself, only alerts afterwards. I'm not familiar with sender constraints, but probably difficult to implement for public clients? Cookies would be a simple and proven solution, at least for *browser-based* public clients.
Yep I agree, there's a draft I'm planning on taking to the group to suggest exactly this. -
-
-
Peter Holz
https://twitter.com/nu4ur
•
Nov 26
Hi @aaronpk, do you know if any OAuth provider like Okta allows to set refresh tokens as HttpOnly cookie and whose token endpoint reads that cookie? Asking for a browser-based public client which can't safely store refresh tokens outside of memory otherwise.
That's non-standard behavior so I'm not sure anyone is doing that. But there is some discussion about bringing this idea into the working group for standardization.
-
This is a great idea!
-
This is your periodic reminder that "Security Questions" are the worst, and if you're a developer or product person who has implemented them, you've done a bad thing and should feel bad about about it. Thankfully, you can repent and redeem yourself by removing them! 😊
-
GNAP Editors' Use of GitHub Issues
The editors met yesterday to discuss the issues that were pulled out of the previous draft text and document a process for how to resolve these and future issues. We would like to explain how we plan on using labels on GitHub issues to keep track of discussions and keep things moving.continue reading... -
-
M. Brandon Lee | THIS IS TECH TODAY
https://twitter.com/thisistechtoday
•
Nov 25
It’s always a goal but rarely does anyone succeed at getting a high number.
I had a test case where I had verbal call outs and when I didn’t. The one with call out had 7-15 people join. The video without?
Zero.
That video also had 5x more views than the others.
Data! 📊🤓
This is good anecdotal data! I will also say I rarely watch videos in full screen, so the like button is always right there. The rare exception is something I've decided ahead of time to watch more immersively like a movie, and chances are I'm already subscribed anyway
