#Oauth

[myconetted]

[transparentgentlemenmarker]

Happy International Bluescreen Day

Ce matin vendredi 19 juillet 2024 les entreprises, compagnies aériennes, banques et des médias sont hors fonctions suite à une mise à jour de CrowdStrike, un antivirus utilisé par Microsoft est à l'origine de la panne.

En 2023

Fin septembre c'est OAuth qui sera appliqué pour les @mail

[mentalisttraceur-software]

It really is very frustrating to try to use Tumblr through the API, because:

First you have to Register An App, even though I am a user, I am trying to just automate some workflows, I am not an App Developer making a third-party integration for others.

Then you must use OAuth. Having an API where the only authentication mechanism is OAuth should be a crime. OAuth is an okay solution for letting third-party code get credentials on behalf of users with user consent. But I am not third-party code!!! I am me, the user; my code is an extension of me, it is me, alkfsdafklsdalfsalf!

Randomly things will just fail to post. You will be told the profoundly helpful status 400, code 8001, which if we go by observation alone are the only possible numbers, and mean any possible error. "Posting failed. Please try again." Incidentally, if you are ever responsible for a "Please try again" error message for something that is not a transient error but will persistently reliably fail, we need to break out the medieval corporal punishments. Flogging. Stocks. Those little cages on street posts. And responsibility goes up the chain of command - the higher the position, the longer the punishment.

This. This will be the thing that finally drives me off Tumblr. No amount of adoring Tumblr fans will keep me if I can't reliably publish posts from the comfort of my text editor.

[newcodesociety]

[knowvergreen]

Passwordless and Passkeys

Ugh! Passwordless ​ Photo by Anna Shvets ​ Passwordless can seem to give some indigestion! 😂 Why? Because the name may suggest that it’s insecure, somehow. It has to be. Right? Nah! Well, not really. It depends on how I, the administrator, set it up and on the end users’ re-education on security. It also would mean an organization re-education as well. Multi-Factor authentication, YubiKey,…

[digitalcreationsllc]

OAuth Apps Used to Automate BEC and Cryptomining Attacks

Attackers target user accounts without robust authentication measures, creating new OAuth apps with high privileges to ensure continued access and hide their malicious activities.

[hitoshikokumai]

OAuth Supporting Biometrics to Get Criminals Discouraged or Delighted?

“Failure to verify OAuth tokens enables account takeover on websites” https://www.csoonline.com/article/657356/failure-to-verify-oauth-tokens-enables-account-takeover-on-websites.html

A friend who read this report has suggested that I should say something on biometrics that OAuth supports for the identity authentication of its users.

Well, my comment will be found in this 2minute video — “Biometrics in Cyber Space” https://youtu.be/wuhB5vxKYlg

If they want to get criminals and adversaries delighted, biometrics would be an excellent tool to achieve the objective.

Should they want to get criminals and adversaries discouraged, they should keep away from biometrics to achieve the objective.

Interested in this subject? — Here is a collection of biometrics-related discussions — “Probabilistic Biometrics Unravelled : How it brings down identity security” https://www.linkedin.com/pulse/biometrics-unravelled-password-dependent-hitoshi-kokumai/

PS We are not against biometrics as a whole. Biometrics is useful for forensics where used with reliable privacy data protection. It could also be helpful for individual identification to screen out bad guys in physical space where citizens are correctly informed of the serious risk that biometrics brings to their privacy.

[techsmarts]

Another great infographic from ByteByteGo that crams a lot of detail into a single page.

This one illustrates the difference between session tokens and JSON web tokens (JWT) and then goes on to show how JWTs are the backbone of modern single sign on (SSO) and OAuth flows.

(via https://substack-post-media.s3.amazonaws.com/public/images/041727d8-aaba-4c1d-8b74-b2c26e2e05e2_1446x1890.png (1446×1890))

[smackcoders]

Securing Your Digital Identity: Get Your Google API and OAuth Credentials Now

As of today, it is so easy to get the Google API and Client credentials with a few clicks via Google Developer Console. Before that, it is essential to know what API and Client credentials are. In this blog, we discuss the API and client credentials and when to use them. Are you searching for the Step by Step instructions to get the API key and OAuth Credentials? Then keep on reading….

Both API keys and OAuth are the different types of authentication handled by Cloud Endpoints.

These two differ most in the following ways:

The application or website performing the API call is identified by the API key.

An app or website’s user, or the person using it, is identified by an authentication token.

API keys provide project authorization

To decide which scheme is most appropriate, it’s important to understand what API keys and authentication can provide.

API keys provide

Project identification — Identify the application or the project that’s making a call to this API

Project authorization — Check whether the calling application has been granted access to call the API and has enabled the API in their project

API keys aren’t as secure as authentication tokens, but they identify the application or project that’s calling an API. They are generated on the project making the call, and you can restrict their use to an environment such as an IP address range, or an Android or iOS app.

By identifying the calling project, you can use API keys to associate usage information with that project. API keys allow the Extensible Service Proxy (ESP) to reject calls from projects that haven’t been granted access or enabled in the API. 

Contrarily, authentication strategies often have two objectives:

Verify the identity of the calling user securely using user authentication.

Check the user's authorization to see if they have the right to submit this request.

A safe method of identifying the user who is calling is provided by authentication mechanisms.

In order to confirm that it has permission to call an API, endpoints also examine the authentication token.

The decision to authorize a request is made by the API server based on that authentication.

The calling project is identified by the API key, but the calling user is not.

An API key, for example, can identify the application that is making an API call if you have developed an application that is doing so.

Protection of API keys

In general, API keys is not seen to be safe because clients frequently have access to them. This will make it simple for someone to steal an API key. Unless the project owner revokes or regenerates the key, it can be used indefinitely once it has been stolen because it has no expiration date. There are better methods for authorization, even though the limitations you can place on an API key minimize this. 

API Keys: When to Use?

An API may require API keys for part or all of its methods.

This makes sense to do if:

You should prevent traffic from anonymous sources.

In the event that the application developer wants to collaborate with the API producer to troubleshoot a problem or demonstrate the usage of their application, API keys identify an application's traffic for the API producer.

You wish to limit the number of API calls that are made.

You want to analyze API traffic to find usage trends.

APIs and services allow you to view application consumption.

You want to use the API key to filter logs.

API keys: When not to use?

Individual user identification – API keys are used to identify projects, not people

On secured authorization

Finding the authors of the project

Step-by-step instructions on how to get Google API and OAuth credentials using the Google developer console.

Step 1

Browse Google developer console

Step 2

Select your project or create a new project by clicking on the New project button

Step 3

Provide your project name, organization, and location, and click on create. 

And That’s it. You have created a New Project.

Step 4

Navigate to the Enabled API and services at the Left sidebar and click on Credentials

Step 5

Move on to create Credentials

Here to get your API key click on the API key. Instantly you will get your API key for your Project.

To get your OAuth Credentials

Navigate to the OAuth Client ID on the Create Credentials drop-down menu.

Step 6

Here you need to create an application. A client ID is used to identify a single app to Google’s OAuth servers. If your app runs on multiple platforms, each will need its own client ID. 

Step 7

Select the appropriate application type from the drop-down

The name of the client will be auto-generated. This is only to recognize the client console and does not show to the end users.

Step 8

Enter your URL for the Authorized JavaScript origins by clicking on Add URL

Provide your Authorized redirect URLs

Finally click on Create

Step 9

You will get an OAuth Client Id and Client Secret instantly.

Epilogue

Getting Google API and OAuth credentials is an important step in developing applications that interact with Google services. It allows developers to access data from Google APIs and services in a secure and reliable way. With the correct setup, developers can create powerful applications that can be used by millions of users. In summary, getting Google API and OAuth credentials is essential for any developer wishing to build web applications that interact with Google services.

[kevalsing]

Custom Oauth provider - add authorization in consuming app

Problem Statement : Not sure about the best way to describe this but I have an app (.net framework 4.8) with a custom OAuthProvider. Calling this APP A. The provider generates an access token based on username and password, when using the app, if they have the correct roles an access token is created for use in APP B. APP B is a .net core 7 app. There is a link to APP B from APP A which passes…

[otaviogilbert]

What are OAuth Security Vulnerabilities | CybersecurityTv

Learn about OAuth security vulnerabilities in this informative video. Explore the potential risks and vulnerabilities associated with OAuth authentication. Stay informed and protect your online accounts.

[laejoh]

oauth-20230522.1900 doesn't work well with tumblesocks

tumblesocks.el stopped working. The oauth library in elpa changed to version oauth-20230522.1900. It doesn't work well with our tumblesocks.el. The previous version oauth-20130128.151 with the string-to-unibyte fix can be found at https://codeberg.org/martianh/emacs-oauth. I git cloned the repository and added the location to the emacs load-path. I can post from emacs again!

[osintelligence]

https://bit.ly/434ASfI - 🔒 A security vulnerability was recently discovered in the Open Authorization (OAuth) implementation of Expo, an open source platform for developing mobile apps. The flaw, tracked as CVE-2023-28131, could potentially expose user accounts, personal data, and even facilitate financial fraud. This is due to OAuth's function as a facilitator of social media login across multiple platforms, like Facebook or Google. The discovery was made by Salt Security's Salt Labs, and this finding poses risks to hundreds of websites and apps that use Expo's framework for user authentication. #CyberSecurity #OAuth #ExpoPlatform 📱OAuth's widespread use in modern service-based architectures and AI-based platforms highlights the severity of such vulnerabilities. In separate research, DoControl, a SaaS security firm, revealed that 24% of third-party AI apps require risky OAuth permissions. This reinforces the need for secure implementations of OAuth across all applications and websites. The flaw within Expo was promptly addressed, with a patch being released hours after Salt researchers brought the issue to light. Despite this quick resolution, the inherent complexity of OAuth configurations suggests there might be undiscovered flaws within other apps and websites. #OAuthVulnerability #AI #CyberRisk 🔍The vulnerability was initially discovered in https://bit.ly/3ODash1, a platform offering free coding classes. The platform boasts around 100 million users, with companies like Google, LinkedIn, Amazon, and Spotify using the site for employee training. The flaw, if exploited, could have led to personal data leaks, financial fraud, or actions performed on behalf of users on their social media accounts. It essentially exposed the possibility for credentials to be sent to a malicious domain instead of the intended website. #Codeacademy #DataLeak #AccountSecurity 🔧OAuth's popularity comes from its ability to provide a seamless user experience. However, its complex, technical back-end can lead to implementation mistakes, which can create security gaps. To secure an OAuth implementation, organizations must have a deep understanding of OAuth's functioning and the potential endpoints that may receive user inputs. Validating these inputs and implementing strict validation methods is a must. Salt Security intends to release a best-practice guide in the future to assist enterprises in effectively securing their OAuth implementations.

[samlssoaspdotnet]

What are the different Use Cases around SSO?

What is Single  Single Sign-On (SSO)?

Single sign-on (SSO) is an authentication process that allows users to access multiple applications, websites, and systems with just one set of login credentials, rather than having to remember and enter separate usernames and passwords for each separate application.

In essence, SSO is a central authentication mechanism that enables users to authenticate just once and has that authentication automatically happen across all the systems they need to access. This reduces the need for users to remember multiple sets of login credentials and minimizes the risk of password-related security breaches and attacks.

How does Single Sign On (SSO) work?

The way SSO works is by using an IDP system that authenticates the user once and then passes that authentication token to the various applications and websites when that user needs access for configuring SSO on your application multiple IDPs such as Shibboleth, Okta, miniOrange, OneLogin, ADFS, and OneLogin.

When a user tries to access an application, the application redirects the user to the IDP, which then authenticates the user and generates an approval token. This token is then passed back to the application, which can use to grant the user access. The token is typically valid till the session is on. You can set the time period for which the session exists and decide the time validity of the token.

There are several different protocols that can be used to implement SSO, including SAML, OAuth, LDAP, and OpenID Connect. The protocol is important as it creates a communication channel between your Service Provider(SP) and Identity Provider(IDP).

What are the different Use Cases around SSO?

Single Sign-On (SSO) has become a popular authentication and authorization mechanism that allows users to access multiple applications, websites, and services with a single set of login credentials. SSO offers many benefits, including enhanced security and improved user experience. In this blog post, we will explore some of the most common use cases for SSO.

Education Use Case

SSO is also widely used in the education sector. Students and staff can use SSO to access various educational resources, such as learning management systems (LMS), online libraries, tests and materials, and online academic journals. SSO also enables universities and schools to better manage user access, reducing the risk of unauthorized access to sensitive data.

Healthcare Use Case

In the healthcare industry, SSO is used to provide secure access to electronic medical records (EMR), patient management systems, insurance, and other healthcare applications. SSO simplifies the authentication process for healthcare providers, allowing them to focus on providing quality service and patient care.

E-commerce Use Case

E-commerce platforms often use SSO to provide customers with a seamless shopping experience. SSO enables customers to use a single set of login credentials to access multiple e-commerce sites, eliminating the need to create separate accounts for each E-commerce site. SSO also enables e-commerce companies to better track customer behavior and preferences, providing them with valuable insights to improve their products and services. 

Government Use Case

SSO is also widely used in the government sector to provide citizens with secure access to various government services, such as tax filing, social security, and other public services. SSO simplifies the authentication process for citizens, reducing the risk of fraud and unauthorized access to sensitive data.

Enterprise Use Case

One of the most common use cases for SSO is in the enterprise. SSO allows employees to securely access various enterprise applications, such as customer relationship management (CRM) systems, enterprise resource planning (ERP) systems, and document management systems, with a single set of login credentials. This reduces the risk of password fatigue and increases productivity by eliminating the need to remember multiple login credentials.

In conclusion, SSO has many use cases across various industries, and its popularity continues to grow as organizations seek to simplify the authentication process and enhance security. Whether you are an enterprise, educational institution, healthcare provider, e-commerce company, or government agency, SSO offers a convenient and secure way to access multiple applications and services.

You can check out our miniOrange ASP.NET solutions for SSO : 

SAML SSO

ASP.NET - https://plugins.miniorange.com/asp-net-saml-single-sign-on-sso 

DNN - https://plugins.miniorange.com/dnn-saml-single-sign-on-sso-module

OAuth SSO

ASP.NET - https://plugins.miniorange.com/asp-net-oauth-2-0-single-sign-on-sso-module 

DNN -  https://plugins.miniorange.com/dnn-oauth-single-sign-on-sso 

[devsnews]

This article overviews some recommended deployment and separation patterns when implementing security solutions for web and API components.