News for hackers. Stuff that matters.

A comment on Open Letter from the OpenID Foundation to Apple Regarding Sign in with Apple.

Re:Open Letter from the OpenID Foundation to Apple Regarding... by jjtheblunt on Saturday June 29, 2019 @05:01PM (#20314752)
Perhaps Apple has intentionally NOT jumped on the OpenID effort without tweaks, for the following reason?

Quoting wikipedia for convenience:

"OAuth 2.0 has had numerous security flaws exposed in implementations.[17] The protocol itself has been described as inherently insecure by security experts and a primary contributor to the specification stated that implementation mistakes are almost inevitable.[18][19]".

[ Parent | on HN ]
Re:Open Letter from the OpenID Foundation to Apple Regarding... by jogux on Sunday June 30, 2019 @03:36AM (#20316913)
Apple are using OAuth 2.0.

The contributor referred to (John Bradley) as saying that OAuth 2.0 implementation mistakes are almost inevitable is one of the authors of the OpenID Connect spec, and if you follow the citation link ( https://mailarchive.ietf.org/arch/msg/oauth/WuT1tmFoxs8S_2v7... ) you'll see him mention that the flaw referred to is fixed in OpenID Connect.

[ Parent | on HN ]