Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously presenting to the user a fake resource provider page to enter the credentials. Typically if the consumer is expected to forward the requester to Facebook let's say but what the consumer does it present to the user a fake Facebook page. That would allow the consumer to spoof the identity of the user in the future...

Did OAuth recommend anything with that regards?

In particular I am interested in use cases in a browser environment.

share|improve this question
add comment

3 Answers

up vote 9 down vote accepted

The OAuth RFC states:

OAuth uses tokens to represent the authorization granted to the client by the resource owner. Typically, token credentials are issued by the server at the resource owner's request, after authenticating the resource owner's identity (usually using a username and password).

There are many ways in which a server can facilitate the provisioning of token credentials. This section defines one such way, using HTTP redirections and the resource owner's user-agent. This redirection- based authorization method includes three steps:

  1. The client obtains a set of temporary credentials from the server (in the form of an identifier and shared-secret). The temporary credentials are used to identify the access request throughout the authorization process.

  2. The resource owner authorizes the server to grant the client's access request (identified by the temporary credentials).

  3. The client uses the temporary credentials to request a set of token credentials from the server, which will enable it to access the resource owner's protected resources.

So to have the authorisation, the client (the site using your data) must redirect you to the server that holds your data for signing up.

At Section 2.2 the RFC states :

The way in which the server handles the authorization request, including whether it uses a secure channel such as TLS/SSL is beyond the scope of this specification. However, the server MUST first verify the identity of the resource owner.

But definitely I (as resource owner) won't use any OAuth-orisation without checking the certificate of the site.

So for OAuth 1.0 this is not mandatory.

The OAuth 2.0 RFC is still a draft but I understand that it requires TLS

10.9. Endpoints Authenticity

In order to prevent man-in-the-middle and phishing attacks, the authorization server MUST implement and require TLS with server authentication as defined by [RFC2818] for any request sent to the authorization and token endpoints. The client MUST validate the authorization server's TLS certificate in accordance with its requirements for server identity authentication.

[...]

10.11[...] To reduce the risk of phishing attacks, the authorization servers MUST utilize TLS on every endpoint used for end-user interaction

Hence the authentication relies on TLS protocol as it was discussed on the blog recently.

To summarise I would suspect any attempt to OAuth without TLS as malicious. And of course the same if the SSL certificates does not validate.

share|improve this answer
add comment

There is no cure for this as it's a typical phishing example, which can be done without including the word OAuth in your post at all...

Every application can redirect its users to a fake "facebook" site, and require the user to enter his facebook credentials. The only remedy is the user himself to look carefully the URL in the browser, when entering his credentials supposedly on "facebook".

As for 2-legged OAuth, you don't have to worry, because this is machine-to-machine communication in which end-users (and browsers) do not participate...

share|improve this answer
add comment

My approach has been to open a new tab and make sure I'm logged into whichever service I intend to authenticate through, lets say Facebook. Then, when the new site redirects me to Facebook, I just have to click something to agree, not enter credentials again. If I'm presented with a form to enter credentials into, I'll know something is wrong.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.