Comments on: Acknowledgement of the OAuth security issue http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/ An open protocol to allow secure API authorization in a simple and standard method from web, desktop, and mobile applications. Mon, 04 Jan 2010 06:09:31 +0000 http://wordpress.com/ hourly 1 By: Peter Keane's Miscellanea · Layers http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-173 Peter Keane's Miscellanea · Layers Mon, 04 Jan 2010 06:09:31 +0000 http://blog.oauth.net/?p=67#comment-173 [...] that allows two separate services to interoperate. Maybe not seamlessly and perhaps not without the occassionaly glitch, but ultimately it works and the results can be astonishing (cf. THE [...] [...] that allows two separate services to interoperate. Maybe not seamlessly and perhaps not without the occassionaly glitch, but ultimately it works and the results can be astonishing (cf. THE [...]

]]> By: A Fire Eagle updater for Windows Mobile « dale lane http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-169 A Fire Eagle updater for Windows Mobile « dale lane Thu, 13 Aug 2009 21:53:24 +0000 http://blog.oauth.net/?p=67#comment-169 [...] the security threat identified in OAuth last April, OAuth providers have got even more cautious, and the updated OAuth protocol is even more [...] [...] the security threat identified in OAuth last April, OAuth providers have got even more cautious, and the updated OAuth protocol is even more [...]

]]> By: a walking city » Blog Archive » Java, OAuth, Signpost http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-168 a walking city » Blog Archive » Java, OAuth, Signpost Sun, 28 Jun 2009 05:48:05 +0000 http://blog.oauth.net/?p=67#comment-168 [...] with a number of services, including Twitter and using the new OAuth 1.0a spec that addresses the vulnerability found in the OAuth spec [...] [...] with a number of services, including Twitter and using the new OAuth 1.0a spec that addresses the vulnerability found in the OAuth spec [...]

]]> By: Web API a bezpečnosť http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-167 Web API a bezpečnosť Tue, 16 Jun 2009 16:37:35 +0000 http://blog.oauth.net/?p=67#comment-167 [...] užívateľa). Dnes už Twitter podporuje aj oveľa lepší OAuth, v ktorom bolo len nedávno objavená bezpečnostná zraniteľnosť, čo viedlo k dočasnému odstaveniu protokolu. Napriek tomu je tento protokol ďaleko [...] [...] užívateľa). Dnes už Twitter podporuje aj oveľa lepší OAuth, v ktorom bolo len nedávno objavená bezpečnostná zraniteľnosť, čo viedlo k dočasnému odstaveniu protokolu. Napriek tomu je tento protokol ďaleko [...]

]]> By: airkart http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-161 airkart Mon, 27 Apr 2009 04:25:05 +0000 http://blog.oauth.net/?p=67#comment-161 Haha, that should be http://blog.ics.utsa.edu. Silly typos! Haha, that should be http://blog.ics.utsa.edu. Silly typos!

]]> By: An update on the OAuth session fixation vulnerability « OAuth http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-157 An update on the OAuth session fixation vulnerability « OAuth Sun, 26 Apr 2009 01:50:48 +0000 http://blog.oauth.net/?p=67#comment-157 [...] OAuth An open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. « Acknowledgement of the OAuth security issue [...] [...] OAuth An open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. « Acknowledgement of the OAuth security issue [...]

]]> By: IT Blog http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-154 IT Blog Sat, 25 Apr 2009 20:32:23 +0000 http://blog.oauth.net/?p=67#comment-154 <strong>OAuth Problem...</strong> We’d like to publicly show our appreciation for Twitter’s role in helping to minimize premature publicity of this threat, even at its own expense, taking the heat as if it was their own issue in order to allow other companies to address this threat. ... OAuth Problem…

We’d like to publicly show our appreciation for Twitter’s role in helping to minimize premature publicity of this threat, even at its own expense, taking the heat as if it was their own issue in order to allow other companies to address this threat.
…

]]> By: Twitter Watch Out OAuth Has Security Problem with Exploits http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-143 Twitter Watch Out OAuth Has Security Problem with Exploits Fri, 24 Apr 2009 21:49:22 +0000 http://blog.oauth.net/?p=67#comment-143 [...] You can read more about this Security Advisory and Security Issue [...] [...] You can read more about this Security Advisory and Security Issue [...]

]]> By: airkart http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-142 airkart Fri, 24 Apr 2009 18:42:27 +0000 http://blog.oauth.net/?p=67#comment-142 Chris, Your post here and the followup on the OAuth site is a very good response explaining the session fixation attack. As a silver lining, it is worth pointing out that the fact that this attack was even detected shows OAuth is gaining traction (and the scrutiny that comes along for the ride). For a "quick fix" to this issue, a post on http://blog.ics.utsa.edu/ covers how this particular attack can be mitigated. Erhan Chris,

Your post here and the followup on the OAuth site is a very good response explaining the session fixation attack. As a silver lining, it is worth pointing out that the fact that this attack was even detected shows OAuth is gaining traction (and the scrutiny that comes along for the ride).

For a “quick fix” to this issue, a post on http://blog.ics.utsa.edu/ covers how this particular attack can be mitigated.

Erhan

]]> By: Top Posts « WordPress.com http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/#comment-141 Top Posts « WordPress.com Fri, 24 Apr 2009 00:54:02 +0000 http://blog.oauth.net/?p=67#comment-141 [...] Acknowledgement of the OAuth security issue I wanted to acknowledge that we are aware of a security threat first reported on by CNET that affects the OAuth [...] [...] [...] Acknowledgement of the OAuth security issue I wanted to acknowledge that we are aware of a security threat first reported on by CNET that affects the OAuth [...] [...]

]]>