How to Hack OAuth
summary
Covers concrete failures and fixes: API keys embedded in mobile apps are decompiled mobile apps and posted on GitHub so attackers impersonate official clients; client secrets go away replaced by PKCE for native apps. Several JWT libraries accept a spoofed algorithm allowing payload tampering — the JWT "alg":"none" exploit — and libraries are changed to require expected algorithms. A phishing worm abuses legitimate Google OAuth prompts to self‑propagate and Facebook’s chained bugs compromise 50 million accounts, all demonstrating what actually went wrong.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:40What is OAuth?
- 3:06How does OAuth work?
- 5:52The hacks
- 7:48PKCE - Proof-Key for Code Exchange
- 9:18JWT - JSON Web Token
- 11:34Attack on Google OAuth
- 14:56Attack on Facebook's access tokens
- 18:01Outro
related talks
36mHow To Hack OAuth｜
47mHacking OAuth
47mTop X OAuth 2 Hacks
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
37mHacking OAuth Pitfalls and Remedies
47m1000 Ways to Die in Mobile Oauth
27mSecurity Issues In OAuth/OIDC Implementations
47mThe Hacker's Guide to JWT Security