<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Arial",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0mm;
margin-right:0mm;
margin-bottom:0mm;
margin-left:42.0pt;
margin-bottom:.0001pt;
mso-para-margin-top:0mm;
mso-para-margin-right:0mm;
mso-para-margin-bottom:0mm;
mso-para-margin-left:4.0gd;
mso-para-margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Arial",sans-serif;}
span.17
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1843465415;
mso-list-type:hybrid;
mso-list-template-ids:-546432592 -1080413828 67698711 67698705 67698703 67698711 67698705 67698703 67698711 67698705;}
@list l0:level1
{mso-level-text:"\(%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:18.0pt;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:42.0pt;
text-indent:-21.0pt;}
@list l0:level3
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%3;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:63.0pt;
text-indent:-21.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:84.0pt;
text-indent:-21.0pt;}
@list l0:level5
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%5\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:105.0pt;
text-indent:-21.0pt;}
@list l0:level6
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%6;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:126.0pt;
text-indent:-21.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:147.0pt;
text-indent:-21.0pt;}
@list l0:level8
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%8\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:168.0pt;
text-indent:-21.0pt;}
@list l0:level9
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%9;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:189.0pt;
text-indent:-21.0pt;}
ol
{margin-bottom:0mm;}
ul
{margin-bottom:0mm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=JA link="#0563C1" vlink="#954F72" style='text-justify-trim:punctuation'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>Just found a briefing in Blackhat 2016 titled <a href="https://www.blackhat.com/us-16/briefings.html#1000-ways-to-die-in-mobile-oauth">“1000 WAYS TO DIE IN MOBILE OAUTH” </a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>Says: <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>> (1) all major identity providers, e.g., Facebook, Google and Microsoft, have re-purposed OAuth for user authentication;”<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>> [..snip..]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>> “The result is really worrisome: among the 149 applications that use OAuth, 89 of them (59.7%) were incorrectly implemented and thus vulnerable.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'>Maybe we should dig in. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal align=left style='text-align:left'><span lang=EN-US style='font-size:10.0pt;font-family:"MS Gothic"'>--<o:p></o:p></span></p><p class=MsoNormal align=left style='text-align:left'><span lang=EN-US style='font-size:10.0pt;font-family:"MS Gothic"'>PLEASE READ :This e-mail is confidential and intended for the<o:p></o:p></span></p><p class=MsoNormal align=left style='text-align:left'><span lang=EN-US style='font-size:10.0pt;font-family:"MS Gothic"'>named recipient only. If you are not an intended recipient,<o:p></o:p></span></p><p class=MsoNormal align=left style='text-align:left'><span lang=EN-US style='font-size:10.0pt;font-family:"MS Gothic"'>please notify the sender and delete this e-mail.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></body></html>