Insecurity protocols: an overview of modern authentication
summary
Covers concrete failures and real tools: JWTs suffer a decade‑old alg none library flaw and fragile custom crypto; OAuth2 uses auth code + token exchange with PKCS E (PKCE) to stop stolen‑code attacks and retires the implicit flow; OpenID Connect returns ID tokens (JWTs) that get misused; SAML breaks on XML canonicalization (examples read external files) and yields frequent auth bypasses and CVSS‑10s; FIDO2/WebAuthn + CTAP2 show clean register/assert flows, while passkeys and resident keys hit storage and sync limits; TPMs expose PCR/event‑log attestation complexity.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:46JSON web tokens
- 7:23OAuth 2.0
- 12:04OpenID connect
- 15:55SAML critique
- 19:23FIDO2 and hardware keys
- 21:57Passkeys
- 25:35Hardware attestation
related talks
55mYou Shall Not Password: Modern Authentication for Web Apps
51mYou Shall Not Password: Modern Authentication for Web Apps
44mPresentation on Security Standards and Protocols
56mLock That Sh*t Down!
01h 02mModern Authentication
39mAPI = Authentication’s Poorly Implemented
31mAuthentication/Authorization Starters Battle
16mInnovation in Authentication and More