Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
toad.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon server operated by David Troy, a tech pioneer and investigative journalist addressing threats to democracy. Thoughtful participation and discussion welcome.

Administered by:

Server stats:

335
active users

toad.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#oauth

3 posts3 participants0 posts today
Public *
Neil Madden

Interesting open letter from the CISO at JP Morgan Chase, calling out insecure SaaS integrations, and specifically lots of implicit/explicit criticism of #OAuth: poorly secured and broadly scoped long-lived bearer tokens are not a great idea. Hopefully we’ll see PoP (with keys in a KMS) becoming more widespread for these kinds of integrations.

(The letter is undated 😤 but I assume it’s recent - via @ladynerd on LinkedIn).

jpmorgan.com/technology/techno

www.jpmorgan.comAn Open Letter to Third-Party SuppliersLearn more about J.P. Morgan's products and services.
Public
Efani

⚠️ Phishers have found a clever way to spoof Google — and their emails pass all security checks.

A new DKIM replay phishing attack abuses Google’s own OAuth infrastructure to send fake messages that look 100% legitimate, including passing DKIM authentication.

What happened:
- A phishing email was sent from “no-reply@google.com”
- It appeared in the user’s inbox alongside real Google security alerts
- The message linked to a fake support portal hosted on sites[dot]google[dot]com — a Google-owned domain
- The attacker used Google OAuth to trigger a real security alert to their inbox, then forwarded it to victims

Why this matters:
- DKIM only verifies the headers, not the envelope — allowing this spoof to work
- The phishing site was nearly indistinguishable from Google’s actual login portal
- Because the message was signed by Google and hosted on a Google domain, it bypassed most users’ suspicions
- Similar tricks have been used with PayPal and other platforms, raising broader concerns

Google has since acknowledged the issue and is working on a fix. But this attack is a reminder:

Even the most secure-looking emails can be fraudulent.
Even Google-signed emails can be weaponized.

🛡️ At @Efani, we advocate for layered defense — because no one layer is ever enough.

#Cybersecurity#Phishing#Google
Public
ResearchBuzz: Firehose

Bleeping Computer: Phishers abuse Google OAuth to spoof Google in DKIM replay attack. “In a rather clever attack, hackers leveraged a weakness that allowed them to send a fake email that seemed delivered from Google’s systems, passing all verifications but pointing to a fraudulent page that collected logins. The attacker leveraged Google’s infrastructure to trick recipients into accessing […]

https://rbfirehose.com/2025/04/21/bleeping-computer-phishers-abuse-google-oauth-to-spoof-google-in-dkim-replay-attack/

#email#emailspoofing#google
Replied in thread
Public
Erik Play2Learn

@elmiko in my python tests #GeminiAI has been pretty good. So galang doesn't worry me that much. Interestingly multiple AIs struggle with #oauth, eg also #lovable .

There aren't even free standing computers and library employees not respecting documentation standards pisses me off. So i have to check now if another library has a free computer. It's already the second library. In the first ive got #hausverbot because I dont want to be #homeless anymore, see other thread on this masto account.

Continued thread
Public
Jörn Franke

Check your programming frameworks. For example, this is currently only planned in the upcoming major Version of the Spring framework github.com/spring-projects/spr

At least for the Rust crate openidconnect-rs this is included in the default example: docs.rs/openidconnect/latest/o

GitHubConsider Enabling PKCE for Authorization Code by Default · Issue #16391 · spring-projects/spring-securityBy rwinch
#oauth#oauth2_1#spring
Public *
Jörn Franke

browsing the specs of OAuth 2.1 and found that PKCE is now mandatory for Authorization Code Flow (not only Desktops or frontend-only apps!):
datatracker.ietf.org/doc/html/

"The authorization code grant is extended with the functionality from PKCE [RFC7636] such that the default method of using the authorization code grant according to this specification requires the addition of the PKCE parameters"

IETF DatatrackerThe OAuth 2.1 Authorization FrameworkThe OAuth 2.1 authorization framework enables an application to obtain limited access to a protected resource, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and an authorization service, or by allowing the application to obtain access on its own behalf. This specification replaces and obsoletes the OAuth 2.0 Authorization Framework described in RFC 6749 and the Bearer Token Usage in RFC 6750.
#oauth#oauth2_1#pkce
ExploreLive feeds
About