WeChat ID
aaronpk_tv
-
Prague, Capital City of Prague, Czech Republic • Sun, November 5, 2023 8:52pm
-
at Hop HousePrague, Capital City of Prague, Czech Republic • Sun, November 5, 2023 7:31pm
-
Prague, Capital City of Prague, Czech Republic • Sun, November 5, 2023 7:09pm
-
Prague, Capital City of Prague, Czech Republic • Sun, November 5, 2023 6:26pm
-
Prague, Capital City of Prague, Czech Republic • Sun, November 5, 2023 6:16pm
-
at Gate 11Hillingdon, Greater London, United Kingdom • Sun, November 5, 2023 2:23pmGate is closing as soon as it opened!
-
Hillingdon, Greater London, United Kingdom • Sun, November 5, 2023 2:07pm
-
Hillingdon, Greater London, United Kingdom • Sun, November 5, 2023 1:27pm
-
London, Greater London, United Kingdom • Sun, November 5, 2023 1:22pm
-
electronic devices are the new smoking
-
at Gate B25Phoenix, Arizona • Sat, November 4, 2023 7:28pm
-
Phoenix, Arizona • Sat, November 4, 2023 5:11pm
-
Phoenix, Arizona • Sat, November 4, 2023 4:38pm
-
at Gate C21Portland, Oregon • Sat, November 4, 2023 1:18pm
-
Portland, Oregon • Sat, November 4, 2023 11:16am
-
at The UncannyPortland, Oregon • Sat, October 28, 2023 7:11pm
-
Portland, Oregon • Sat, October 28, 2023 12:43pm
-
Aaron Parecki
https://aaronparecki.com/
•
Oct 26
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
tl;dr: Don't accept access tokens in your redirect URI (don't use the implicit flow)
PKCE solves this attack and is enforced by the server rather than relying on client developers to "verify the access token" as described in the post -
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
