Timeline for Why is PKCE secure against man-in-the-middle attacks?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 8:14 | history | edited | CommunityBot |
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| Apr 3, 2019 at 14:25 | comment | added | ecdsa | How is a) a problem with TLS? Or are your referring to the redirect on the client? And b) is technically not a MITM attack (RFC 8252 might have more information on mitigating such attacks). | |
| Apr 3, 2019 at 10:06 | vote | accept | Raiden616 | ||
| Apr 3, 2019 at 10:06 | |||||
| Apr 3, 2019 at 10:06 | vote | accept | Raiden616 | ||
| Apr 3, 2019 at 10:06 | |||||
| Apr 3, 2019 at 10:06 | comment | added | Raiden616 | Ah okay, I missed that sentence in RFC 6749. That said my security concerns haven't really been quashed; I'm still concerned about: a) QS parameters being insecure even under TLS; b) An impersonating application. But after doing a bit more reading (hackernoon.com/strengthening-oauth2-for-mobile-f4f3925dbf18 and web-in-security.blogspot.com/2017/01/… illustrate some of my concerns), I've concluded that basically the answer is: it's not. But you've answered my question in terms of with what PKCE DOES help, so thank you very much for your time. | |
| Apr 3, 2019 at 8:56 | history | answered | ecdsa | CC BY-SA 4.0 |