Token Theft Prevention (dPoP) – Nth Time is the Charm.
summary
Examines token-theft risks despite MFA/FIDO2 adoption and reviews existing standards for preventing token theft, with a focus on dPoP. Evaluates implementation options and compares them against current enterprise risk to identify practical paths forward for token security.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:13Adoption of Tech
- 2:53The Fog Behavior Model
- 5:54Separate the Concerns
- 8:12Issuer Trust
- 10:22Oauth Access Tokens
- 11:53Revocation
- 14:23Token Theft
- 15:32Mitigation Strategies
- 16:16Proof of Possession
- 20:50Tls Token Binding
- 30:43Attacks
- 36:08Sudden Changes in Permissions
- 41:06Recap
- 43:41What Is Your Recommendation on Access Token or Refresh Token Validity Period
- 47:50The Revocation Endpoint
- 49:13Token Introspection
related talks
18mSafeguarding Web Applications Against Token Theft: Fortifying Security and Trust
58mOAuth and the long way to Proof of Possession
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
19mAdvanced Authentication Framework
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
31mThe business case for FIDO token
47mOAuth and Proof of Possession - The long way round
14mSecuring Authentication with and within FIDO