Hacker News Reader

No, it is not a flaw in the OAuth core logic. From the paper's intro:

> "the OAuth2.0 standard does not cover or define the critical security requirements and protocol details to govern the interactions between the 3rd-party (client-side) mobile app and its corresponding backend server during the SSO process. As a result, various IdPs have developed different home-brewed extensions..."

View on HN

How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic?

An entry security product that doesnt define any security on entering...

Pure Genius.

I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.

https://m.youtube.com/watch?v=zKuFu19LgZA

Reply on news.ycombinator.com