WeChat ID
aaronpk_tv
#security
-
Remember how I always say make sure you audit your third-party JavaScript you embed in your apps, especially in your login pages? Classic example right here, someone inserted malware into the @Twilio SDK because it was in a publicly writable S3 bucket. 😱 https://www.twilio.com/blog/incident-report-taskrouter-js-sdk-july-2020 -
Hey @Linode why do you have so many ad trackers on your *login* domain? Of all places that's where you want to use as little 3rd party JS as possible!
Visiting login.linode.com loads trackers from Facebook, Doubleclick, Impact Radius, Oktopost, Linkedin, Google Ads, Bing -
I'm going live with @afitnerd in 5 minutes to talk about OAuth, online security, and also chat about yesterday's massive #TwitterHack! Join us, and bring your OAuth questions! https://youtu.be/dJl5wNAPm-w
-
If you run a community Twitter account, this is a good time to:
1) Make sure you 100% know everyone who has access to it
2) Enable two-factor authentication
You do *not* want to be in the position of having to explain that your account has been taken over by racists -
The Real Cause of the Sign In with Apple Zero-Day
The zero-day bug in Sign In with Apple actually had nothing to do with the OAuth or OpenID Connect part of the Sign In with Apple exchange, and very little to do even with JWTs. Let's take a closer look to see what actually happened.continue reading... -
Outstanding talk about #OAuth and OAuth #security by @aaronpk https://www.youtube.com/watch?v=aU9RsE4fcRM
