Hacking OAuth

on YouTube ↗47m

" summary

Examines real breaches (Twitter API key leaks, OAuth phishing that mimicked Google Docs) and maps each to OAuth mechanics and fixes: covers authorization code with PKCE, implicit, password and client credentials, and the back-channel token exchange; documents the Security BCP recommendations to deprecate implicit and password grants, require exact redirect matching, and rotate refresh tokens (one-time use) to detect theft; describes OAuth 2.1 consolidation, dynamic client registration, and practical architectures for browser, native, and server apps.

AI-written summary · about

" chapters (14)

1. 0:00Introduction to OAuth
2. 1:25Problem OAuth solves
3. 4:55OAuth core concepts
4. 7:47Front and back channel flows
5. 10:53Client secrets in apps
6. 13:48PKCE explained
7. 18:25Implicit flow alternatives
8. 20:13Password grant risks
9. 25:33Redirect URL security
10. 27:01OAuth 2.1 simplification
11. 31:54Client types and identity
12. 33:59Social engineering attacks
13. 35:23OAuth 2.1 future
14. 35:44Q&A session

" related talks

• 18mHow to Hack OAuthAaron Parecki · GOTO Chicago 2020
• 36mHow To Hack OAuth｜Aaron Parecki · Øredev 2019
• 47mTop X OAuth 2 HacksAntonio Sanso · Voxxed Days Ticino 2017
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 46mA Deep Dive into the Past, Present & Future of OAuthAaron Parecki · GOTO Chicago 2024
• 37mHacking OAuth Pitfalls and RemediesMicah Silverman · Devnexus 2021
• 44mThe Art of Authentication for Web AppsKim Maida · Build Stuff 2022
• 53mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC London 2020