Tirsdag – 1 · Frimurerlosjen, rom 2
Security Specialist at Binary Security
Sofia works as a security specialist at Binary Security. She started her career with a PhD in pure maths, followed by three years at Cisco developing one of their networking OSs. She eventually made her way into security testing, which she has been doing for three and a half years.
OAuth 2.0 is an authorization framework that at its core allows delegating access to websites and applications. Although great when used properly, someone might claim that OAuth 2.0 is a complexity nightmare with its 75 page main RFC and a handful of related RFCs for glued on security measures and extensions. People love misusing OAuth 2.0, with a particular favourite being using it as a pseudo-authentication protocol. This resulted in the creation of OpenID Connect (OIDC), an authentication protocol built on top of OAuth 2.0. In a shocking twist, OIDC became even more complicated than its parent.
In this talk I will talk about various security vulnerabilities in OAuth and OIDC that have arisen from this complexity (according to me).
Programmet er oppdatert.