Hacker News Reader

authnopuzon After dissing Anthropic for limiting Mythos, OpenAI restricts access to Cyber

Good but not necessarily better that was is already pay-as-you-go available today. ref. https://www.flyingpenguin.com/the-boy-that-cried-mythos-veri...

This AISLE benchmark is interesting in this matter: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jag...

And the recently discovered Copy Fail by Xint code is another proof that the gating is overblown: https://xint.io/blog/copy-fail-linux-distributions

authnopuzon AI Agent Authentication and Authorization IETF RFC Draft

One of the Co-Authors here

There are two elements here. Agent can start a full authorization request with AS through authorization code grant flow, even requiring a step-up or some rich authorization details, therefore whatever OTP by SMS or Magic link is an AS - Subject/Client "problem".

For Agent that cannot start a full authorization request (too costly, to complex, subject directly unreachable at the moment), we have a mention to OpenID Connect CIBA into it. With it, the Agent will start a back channel authorization request with the AS and the AS will use a method of authentication / confirmation with the subject in front channel, for example sending a SMS or sending a link to click. Again the resolution will remain an AS - Subject/Client "problem".

authnopuzon Show HN: Browser-based interactive 3D Three-Body problem simulator

And to be fair, Liu Cixin's book is a 4 bodies problem :)

authnopuzon Show HN: Browser-based interactive 3D Three-Body problem simulator

Nightfall by Asimov was a 7 bodies problem - https://en.wikipedia.org/wiki/Nightfall_(Asimov_novelette_an...

authnopuzon Guy running a Google rival from his laundry room

hug of death? I fear the temperature will get very high in his laundry room

authnopuzon Guy running a Google rival from his laundry room

https://archive.is/HA7y4

authnopuzon The Agentic Systems Series

The authentication section is very bizarre, the Agent should go through an OAuth(2?) process to finally access server through an API Key? That sounds more painful than bringing a better state of security...

authnopuzon WonderHuman: 3D avatars from single-view video

Man, we all have been bluffed by this scene

authnopuzon OWASP Non-Human Identities Top 10

Another good source of NHI definitions, concepts, and threats https://nhimg.org/the-ultimate-guide-to-non-human-identities

authnopuzon Dear OAuth Providers

If you consider the newest rfc9068: https://datatracker.ietf.org/doc/html/rfc9068 for JWT profiled Access Token, the list of discrepancies is even longer.

authnopuzon Dear OAuth Providers

Hear. This one! So many of customers have been stabbed in the back with this one