tonywok

I'm familiar with the oauth2 spec (rfc6749). I can't find enough details to actually understand the claimed vulnerability. Does it a specific flow? It sounds like the Implicit Grant (http://tools.ietf.org/html/rfc6749#section-4.2)

> Covert Redirect flaw uses the real site address for authentication.

That is so vague. Are they claiming the attacker is hijacking the redirect_uri parameter?

Are they saying that these third parties aren't comparing the redirect_uri? I can't think of a oauth2 server I've interacted with as a developer that hasn't required you to register a redirect_uri.

Anyone have more details?

Anything that causes a connection or association of ideas that wouldn't have otherwise been formed holds the potential to facilitate a deeper understanding of ones' self or the universe.

Even in my limited experimentation with drugs, I feel as though I've experienced thought outside the realm of regularity.

You're awesome. Just upgraded to the latest! Thanks!

Great job guys! :)

Here's a few of my favorites I read this year:

1. Incognito: The Secret Lives of the Brain by David Eagleman

2. Sum: Forty Tales from the Afterlives by David Eagleman

3. Developing a Universal Religion by David Hockey

4. Moonwalking with Einstein by Joshua Foer

That's rad man. Haters gonna hate. Keep shippin'

Yeah, definitely going to try that out my next mobile app. Great article.

Oh I just want to give github the biggest bear hug. You guys rock.