Subject: [OAUTH-WG] Some recent FUD about OAuth

From: Antonio Sanso <[email-masked]>
Date: Mon, 11 Apr 2016 07:04:34 +0000

Just sharing, do not shoot the messenger :)

http://insanecoding.blogspot.com/2016/04/oauth-why-it-doesnt-work-and-how-to-zero-day-attack.html

and  companion website:

http://no-oauth.insanecoding.org/

regards

antonio

---

From: Hans Zandbelt <[email-masked]>
Date: Mon, 11 Apr 2016 09:26:34 +0200

"JWT is a specification for allowing SSO or API usage between services. 
In many ways JWT is like SAML"

makes me stop trying to parse/understand the rest of it

Hans.

On 4/11/16 9:04 AM, Antonio Sanso wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Hans Zandbelt              | Sr. Technical Architect
[email-masked] | Ping Identity

---

From: Antonio Sanso <[email-masked]>
Date: Mon, 11 Apr 2016 07:37:03 +0000

hi Hans,

indeed I found this article technically inaccurate and it annoyed me quite a bit…

regards

antonio

On Apr 11, 2016, at 9:26 AM, Hans Zandbelt <[email-masked]> wrote:

> "JWT is a specification for allowing SSO or API usage between services. In many ways JWT is like SAML"
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 11 Apr 2016 21:12:21 +0200

Antonio,

you should recommend him/her your new OAuth book! This may help to get
some of the misconceptions about OAuth clarified!

Ciao
Hannes