Yet another reason why Token Exchange is dangerous š¤Æš±
"Bing is allowed to issue Office tokens for any logged-on user"
https://twitter.com/hillai/status/1641146523990753290
WeChat ID
aaronpk_tv
#security
-
-
another day, another account takeover caused by an open redirector and the OAuth Implicit flow š«
https://salt.security/blog/traveling-with-oauth-account-takeover-on-booking-com -
I'm a big fan of using more secure two-factor authentication methods like a security key or TouchID, but I will admit I never expected charging people to use SMS would be a viable strategy to get them off it š https://blog.twitter.com/en_us/topics/product/2023/an-update-on-two-factor-authentication-using-sms-on-twitter
-
I've given many talks about how mobile apps can't be deployed with a secret, and using Twitter's 2013 "hacks" as an example. I'm just going to leave this completely unrelated string of random characters here for no particular reason
GgDYlkSvaPxGxC4X8liwpUoqKwwr3lCADbz8A7ADU -
Remember folks, "token exchange" does *not* mean "let me exchange a customer ID for a token"!
Good thread on how remotely connected Honda, Nissan, Infiniti, and Acura cars were all able to be remotely controlled knowing only the VIN.
https://twitter.com/samwcyo/status/1597792145691246593 -
This is your scheduled periodic reminder, for no particular reason, that now is a good time to review the third party OAuth apps that have access to your Twitter account, and remove any that you don't recognize or haven't used in a while.
ā” https://twitter.com/settings/connected_apps -
What could possibly go wrong? https://twitter.com/racheltobac/status/1588367452043235328
-
Made a new illustration to use in my slide decks.
I often talk about choosing where on the security vs usability dial you want your systems to be, so I figured it was time to have a visual for that.
-
Do I know anyone who knows the right malware analysis tools to determine whether an app accesses any files on the computer or what remote servers it connects to? I want to know more about what this particularly well targeted malware is trying to do.
-
After some great presentations and discussions at the OAuth Security Workshop and European Identity and Cloud Conference, I wrote up some of my thoughts on OAuth and native app impersonation #eic2022 #osw #oauth
https://developer.okta.com/blog/2022/06/01/oauth-public-client-identity -
Sad but true thread on the state of corporate security https://twitter.com/crdudeyoutube/status/1529994566115348485
-
There's nothing like being at #EIC2022, a conference all about identity and security, where phishing and hacking have been a major theme across all the talks, and then getting a "is this you?" push on my phone from an IP on a sketchy VPN followed by a password reset email
