How To Hack OAuth｜
summary
Covers concrete failures: leaked native app keys forcing adoption of PKCE; token forgery by manipulating headers in the JWT alg none bug; a fast‑spreading consent phishing that abuses approval screens in the Google Docs phishing worm; and chained internal bugs that issue other users’ tokens in the Facebook 50 million token flaw. Each case shows the exact exploit path, the tools or API behavior used, the surprising scale, and the practical fixes that did or did not stop the abuse.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:54SO... how can I let an app access my data without giving it my password?
- 4:31HOW OAUTH WORKS
- 12:33DON'T PUT SECRETS IN NATIVE APPS!
- 13:14PKCE - PROOF-KEY FOR CODE EXCHANGE RFC 7636
- 16:38JWTS ARE OFTEN USED FOR API AUTHENTICATION AND AS OAUTH ACCESS TOKENS
- 19:44Treat the JWT header as untrusted external information
- 20:09Never let the JWT header determine your verification mechanism
- 24:52Google API Services: User Data Policy
- 30:34The vulnerability was the result of the interaction of three distinct bugs
- 34:41Keep clean security boundaries even for internal applications
- 35:26Don't let applications pretend to be other applications or other users
related talks
18mHow to Hack OAuth
47mTop X OAuth 2 Hacks
47mHacking OAuth
37mHacking OAuth Pitfalls and Remedies
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...
47m1000 Ways to Die in Mobile Oauth
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows