News for hackers. Stuff that matters.
Re:Google Web Environment Integrity Is the New Microsoft Tru... by solatic on Thursday July 27, 2023 @11:36AM (#36895170)
> there's a lot of trust in that model

No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.

Re:Google Web Environment Integrity Is the New Microsoft Tru... by AnthonyMouse on Thursday July 27, 2023 @02:08PM (#36897807)
OAuth isn't designed to be secure against token issuers conspiring with services to deanonymize users.