Aaron Parecki

oauth 1.0: all this signing request data is too hard
oauth 2.0: [adding JWT and public key crypto and DPoP and PKCE] yes I agree

Thank you to all who attended my talk on “Securely Identifying Mobile Apps”!! I referenced two additional resources which can be found here: [1] https://speakerdeck.com/aaronpk/app-integrity-attestations-for-oauth-oauth-security-workshop-2022 [2] https://danielfett.de/2020/11/27/improving-app2app/#EIC2022 @aaronpk @josephheenan

A dashing @gffletch presents at @kuppingercole #EIC2022 on a perma-problem in OAuth, determining the identity of a public client.
Note the magistral use of http://identicons.dev 💪

I have been informed that it is not likely intentional but the marketing team isn't in town to ask. #eic2022

My ability to dissociate has become too powerful. Now I’m just watching the fall of America like “hmm yeah that happens to empires” while I look for dog hats on Amazon.

Remember the step-up authn proposal @__b_c and yours truly brought up at #OSW and presented at #IETF103?
Well, today the draft has been officially adopted by the OAuth WG!
Thx to everyone who already provided feedback. Now that true work begins 💪 https://www.ietf.org/archive/id/draft-ietf-oauth-step-up-authn-challenge-00.html

I don’t even know how to adequately react to the realization that I’ve “lost” more money in the past 6 months than I used to make in a year, with a third of that being in the last week. It’s just hilarious because it has to be.

In addition to my ongoing plea for no one to check their 401ks, I would also like to posit that money isn’t real since we all clearly have none of it anymore.

I always thought burnout happened when you work too much.

Now I get it. It's investing emotionally and then not getting a return on that investment.

At the risk of speaking “sacrilege”… is decentralization possible? It seems our industry has tried this multiple times and it has “failed”. Mainframe -> PC -> Cloud. The most recent example, FIDO with credentials decentralized and now with PassKey they are centralized again :)

React, Angular and so on have gotten a bit of bashing recently. So I wrote an article defending these technologies

Enjoy.

https://williamkennedy.ninja/javascript/2022/05/03/in-defence-of-the-single-page-application/

2.5 years of Zoom mediated presentations made people forget how to design slides meant to be displayed via a projector

web3 is a beautiful thing. instead of designing & engineering a product, you just make a landing page that takes people’s money and tweet about it.

literally eliminates 99% of the risk of starting up. you’re an idiot if you try to make money on the internet in any other way.

google in 2022 is dogshit bc if i want to search "check mouse dpi" it comes up with 10000000 AI-driven tech blogs of which the content is eighteen paragraphs of:

What is the DPI Mouse?
Many people would like to check their DPI of mouse. The DPI of a mouse is the dots-per-second

Cards against identity at @secworkshop dinner.

https://linktr.ee/oauth2 - a one-stop list of RFC numbers, nicknames and links to OAuth 2.0 specifications. Quick to scroll and an easy to remember resource for beginners! Good for presentations and for pretending your memory is perfect when making comments at @secworkshop #osw7

More tables! 2/2

The #osw7 dinner in Trondheim - as seen by @aaronpk's 360 camera 1/2

@tlodderstedt comments that this may be for app and BFF and it may not be a good idea to cross the boundary. #osw7

@aaronpk comments back that for the cases with limited backend, we may as well cross the boundary.

Very informative talk > App Integrity Attestations as OAuth Client Authentication
Aaron Parecki #osw7