WeChat ID
aaronpk_tv
-
-
Brandon Trebitowski
https://brandontreb.com
•
Mar 3
True, but it would be tricky.
Wouldn’t the attacker have find a way to extract the
code_verifierfrom local storage and pass it along with the hijacked redirect?They would have to somehow have the ability to write custom js code on the path they are redirecting to. I guess this is possible on sites that don’t sanitize user inputs.
I was thinking the attacker makes up their *own* `code_verifier` and injects that into the first open redirect -
Yep! This is exactly the kind of thing PKCE prevents! With PKCE, even if the open redirect were in place, the attacker wouldn't have been able to do anything with the stolen authorization code.
Although now I'm thinking this through and if the open redirects are really open enough, you could probably still pull something off even while using PKCE. -
another day, another account takeover caused by an open redirector and the OAuth Implicit flow 🫠
https://salt.security/blog/traveling-with-oauth-account-takeover-on-booking-com -
Charlotte Brandhorst-Satzkorn
https://inuh.net/@catzkorn
•
Mar 2
Ever wanted to use your own choice of OIDC IdP with @tailscale? I'm looking for private alpha testers - new and existing users welcome. DM me!
I would love to check this out actually, I'm working on some documentation to help companies like Tailscale adopt features exactly like this!
I don't have a way to DM you on mastodon but you can email me! https://aaronparecki.com/contact/ -
Vittorio
https://twitter.com/vibronet
•
Mar 1
Finally took pics of the @Delta Parallel Reality experience. TL;DR, you scan your BP and a smart billboard uses face recognition to present your information just to you, using a parallactic display to ensure your text can only be seen from your position.
Big Delta fan, Diamond… https://twitter.com/i/web/status/1631049565699813377
-
No only did this $8 tweet cost Eli Lilly $15 billion in market cap, it eventually led to an insulin price cap. I think we can safely call this the greatest shitpost in the history of the internet. https://twitter.com/nbcnews/status/1630918613577154561
-
