Apple Safari URI Spoofing (CVE-2015-5764)intothesymmetry.blogspot.com1 points·by asanso·hace 11 años·0 comments
On (OAuth) token hijacks for fun and profit (Google/Microsoft integration)intothesymmetry.blogspot.com1 points·by asanso·hace 11 años·0 comments
Open Redirect in Rfc6749 aka 'The OAuth 2.0 Authorization Framework'intothesymmetry.blogspot.com2 points·by asanso·hace 11 años·0 comments
Top 5 OAuth 2 Implementation Vulnerabilitiesintothesymmetry.blogspot.com2 points·by asanso·hace 12 años·0 comments
asanso·hace 9 años·discussI agree on all the accounts on what you said. I am probably biased by the fact I like JSON over XML. Probably JOSE just took the wrong path and could have been designed way better than it is...
asanso·hace 9 años·discussIt seems that Matthew Green warned them about some of their choices though back in 2012!! https://www.ietf.org/mail-archive/web/jose/current/msg00366....
asanso·hace 9 años·discussThe author of http://blog.intothesymmetry.com/2017/03/critical-vulnerabili... here FWIW. Personally I would not be so drastic. JOSE per se is not too bad (at least the idea is cool). Some crypto choices though have been really arguable...
asanso·hace 10 años·discusshi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
asanso·hace 10 años·discusshi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...