Hacker News Reader

This isn't an "implimentation flaw". Its a fundamental flaw in the core logic.

->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim’s (this would be obtained from public information).

View on HN

No, it is not a flaw in the OAuth core logic. From the paper's intro:

> "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."

How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic?

An entry security product that doesnt define any security on entering...

Pure Genius.

I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.

https://m.youtube.com/watch?v=zKuFu19LgZA

Reply on news.ycombinator.com