<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">The OS attestation tha tWilliam and I are working on is our best bet to mitigate client spoofing.<div class=""><br class=""></div><div class="">The other is to use a cookie in the browser to show that it is not a web view in combination with claimed app claimed https redirect URI. </div><div class="">That is mentioned in <a href="https://tools.ietf.org/html/draft-ietf-oauth-native-apps" class="">https://tools.ietf.org/html/draft-ietf-oauth-native-apps</a> though we may need to flesh out how a server detects if it is talking to a web view.</div><div class=""><br class=""></div><div class="">I personally would like to see the app stores ban apps that use webviews, that would allow the app claimed https redirect URI to be more reliable.</div><div class=""><br class=""></div><div class="">Using the attestation with the token binding id as the nonce is the most reliable way to do it at the moment.</div><div class=""><br class=""></div><div class="">The work we have been doing with AppAuth on mobile is now spreading to desktops like windows and OSX as well. Those are one of the first places to beef up token verification.</div><div class=""><br class=""></div><div class="">I agree that we should do something for server clients as well. That might also include token binding support for token verification in the future as well.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><div><blockquote type="cite" class=""><div class="">On Aug 10, 2016, at 3:42 AM, Adam Dawes via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I just looked through the deck and it seems that most of these relate to OAuth2 based auth flows. At the end, one of the recommendations is to adopt OIDC. <div class=""><br class=""></div><div class="">But in our experience, developers also get OIDC wrong far too often. The thing that is the biggest problem is proper ID token verification (issuer and audience checks). I really think that the community would be very well served with excellent open source JWT validation libraries on all major frameworks/languages. Google would be very interested in working with others on this problem. Please let me know if you have interest/ideas about how to improve this.</div><div class=""><br class=""></div><div class="">The other area that concerns me but doesn't seem to be a major issue yet is clientID spoofing on platforms like iOS. Users don't pay enough attention to consent screens so spoofing another client is an interesting phishing vector.</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Tue, Aug 9, 2016 at 10:00 PM, Nat Sakimura via Openid-specs-ab <span dir="ltr" class=""><<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank" class="">openid-specs-ab@lists.openid.net</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="JA" link="#0563C1" vlink="#954F72" class=""><div class="m_-3740045064026154810WordSection1"><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">Just found a briefing in Blackhat 2016 titled <a href="https://www.blackhat.com/us-16/briefings.html#1000-ways-to-die-in-mobile-oauth" target="_blank" class="">“1000 WAYS TO DIE IN MOBILE OAUTH” </a><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">Says: <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">> (1) all major identity providers, e.g., Facebook, Google and Microsoft, have re-purposed OAuth for user authentication;”<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">> [..snip..]<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">> “The result is really worrisome: among the 149 applications that use OAuth, 89 of them (59.7%) were incorrectly implemented and thus vulnerable.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class="">Maybe we should dig in. <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal" align="left" style="text-align:left"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"" class="">--<u class=""></u><u class=""></u></span></p><p class="MsoNormal" align="left" style="text-align:left"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"" class="">PLEASE READ :This e-mail is confidential and intended for the<u class=""></u><u class=""></u></span></p><p class="MsoNormal" align="left" style="text-align:left"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"" class="">named recipient only. If you are not an intended recipient,<u class=""></u><u class=""></u></span></p><p class="MsoNormal" align="left" style="text-align:left"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"" class="">please notify the sender and delete this e-mail.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span lang="EN-US" class=""><u class=""></u> <u class=""></u></span></p></div></div><br class="">______________________________<wbr class="">_________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.<wbr class="">net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank" class="">http://lists.openid.net/<wbr class="">mailman/listinfo/openid-specs-<wbr class="">ab</a><br class="">
<br class=""></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div style="line-height:1.5em;padding-top:10px;margin-top:10px;color:rgb(85,85,85);font-family:sans-serif;font-size:small" class=""><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(213,15,37);padding-top:2px;margin-top:2px" class="">Adam Dawes |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(51,105,232);padding-top:2px;margin-top:2px" class=""> Sr. Product Manager |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(0,153,57);padding-top:2px;margin-top:2px" class=""> <a href="mailto:adawes@google.com" target="_blank" class="">adawes@google.com</a> |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(238,178,17);padding-top:2px;margin-top:2px" class=""> +1 650-214-2410</span></div><br class=""></div></div>
</div>
_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></blockquote></div><br class=""></div></body></html>