Using TLS makes it acceptable to send cleartext passwords. I don't know why, seems lazy.
So, I understand why Mastercard doesn't rely on that.
Why Mastercard Doesn't Use OAuth 2.0
11–20 of 56 posts
Re: Why Mastercard Doesn't Use OAuth 2.0
#12Earlier quoted context omitted.
It's quite common for companies to MITM https requests (and install their personal certificate on all company owned machines so the browser raises no errors). Some countries do so as well, for example Kazakhstan and China.
And people from that country have those certificates installed? Voluntarily?
In case of countries, you don't need the certificate installed for MITM to work. You just need it if you want to get rid of the warning on every single https website. Unless you tunnel your traffic, it's visible.
In case of large corps, you get assigned a laptop / desktop setup by the company. You probably authenticate to the AD and don't even get the privileges to add/remove certificates.
Re: Why Mastercard Doesn't Use OAuth 2.0
#13I'm not sure I understand the concern with integrity of OAuth 2.0 payloads. Sending the request over HTTPS already ensures that the request is not tampered with, and also guards against replay attacks.
no. You don't know where the TLS terminates.
Re: Why Mastercard Doesn't Use OAuth 2.0
#14This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS. No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
Can't they just also require that their implementation of OAuth2 also requires a signed payload?
Re: Why Mastercard Doesn't Use OAuth 2.0
#15Using TLS makes it acceptable to send cleartext passwords. I don't know why, seems lazy. So, I understand why Mastercard doesn't rely on that.
> TLS makes it acceptable to send cleartext passwords
What do you mean? There exists a NULL cipher, but it needs to be agreed on by both sides. If mastercard doesn't allow NULL, you can't send anything in cleartext. Or did you think of something else?
Re: Why Mastercard Doesn't Use OAuth 2.0
#16Earlier quoted context omitted.
And people from that country have those certificates installed? Voluntarily?
In case of countries, you don't need the certificate installed for MITM to work. You just need it if you want to get rid of the warning on every single https website. Unless you tunnel your traffic, it's visible. In case of large corps, you get assigned a laptop / desktop setup by the company. You probably authenticate to the AD and don't even get the privileges to add/remove certificates.
Also, if the country has its own root CA, it can just sign arbitrary certificates. https://en.wikipedia.org/wiki/CNNIC#Fraudulent_certificates
Re: Why Mastercard Doesn't Use OAuth 2.0
#17This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS. No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
They (quasi-implicitly) say that a design goal of their system is "message level security", and stress the desire for "non-repudiation", which is not provided by TLS per se.
TLS client certs are a thing
Re: Why Mastercard Doesn't Use OAuth 2.0
#18Using TLS makes it acceptable to send cleartext passwords. I don't know why, seems lazy. So, I understand why Mastercard doesn't rely on that.
> TLS makes it acceptable to send cleartext passwords What do you mean? There exists a NULL cipher, but it needs to be agreed on by both sides. If mastercard doesn't allow NULL, you can't send anything in cleartext. Or did you think of something else?
The problems are before and after the TLS tunnel.
I've seen a BigCorp load balancer / web firewall log the first 1KB of each HTTP POST body into a permanent archive. A typical login submission is much smaller than that. Also in some networks the TLS connection is terminated by a frontend server and backend communication is plaintext HTTP.
While these examples are obviously bad practice, having your requests signed and not leak user passwords would easily nullify their impact.
Re: Why Mastercard Doesn't Use OAuth 2.0
#19This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS. No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
Can't they just also require that their implementation of OAuth2 also requires a signed payload?
Then it would no longer be oauth2? Standards exist to prevent deviations. How do you manage signing keys and distribute them? What signature scheme,encoding,etc... Should be used?
Re: Why Mastercard Doesn't Use OAuth 2.0
#20Earlier quoted context omitted.
It's quite common for companies to MITM https requests (and install their personal certificate on all company owned machines so the browser raises no errors). Some countries do so as well, for example Kazakhstan and China.
And people from that country have those certificates installed? Voluntarily?
Just a single data point but the last time I was in Beijing, my iPhone prompted me to install a certificate before I could hop on to the airport WiFi.
I just spent the next 3 hours of the layover without internet.