asanso
Re:JSON Web Tokens should be avoided
on Tuesday March 14, 2017 @08:45AM (#13867035)
I agree on all the accounts on what you said. I am probably biased by the fact I like JSON over XML.
Probably JOSE just took the wrong path and could have been designed way better than it is...
Re:JSON Web Tokens should be avoided
on Tuesday March 14, 2017 @08:35AM (#13866956)
It seems that Matthew Green warned them about some of their choices though back in 2012!! https://www.ietf.org/mail-archive/web/jose/current/msg00366....
Re:JSON Web Tokens should be avoided
on Tuesday March 14, 2017 @08:24AM (#13866892)
The author of http://blog.intothesymmetry.com/2017/03/critical-vulnerabili... here FWIW. Personally I would not be so drastic. JOSE per se is not too bad (at least the idea is cool). Some crypto choices though have been really arguable...
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
on Thursday January 28, 2016 @10:52AM (#10988871)
indeed. but there is always Static DH :) even if not so popular...
Re:OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
on Thursday January 28, 2016 @10:46AM (#10988830)
hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
On (OAuth) token hijacks for fun and profit (Google/Microsoft integration)
Open Redirect in Rfc6749 aka 'The OAuth 2.0 Authorization Framework'
Top 5 OAuth 2 Implementation Vulnerabilities
Re:Are your GitHub's data safe?
on Thursday August 14, 2014 @09:23AM (#8177278)
I hope Firefox will also implement nosniff
Are your GitHub's data safe?
How I have hacked Facebook again and would have stolen a valid access token)
http://intothesymmetry.blogspot.ch/2014/04/oauth-2-how-i-have-hacked-facebook.html
How I have hacked Facebook again and would have stolen a valid access token)
OAuth and Bug Bounty from Facebook and Google
http://intothesymmetry.blogspot.ch/2014/02/oauth-2-attacks-and-bug-bounties.html