Why Mastercard Doesn't Use OAuth 2.0
developer.mastercard.com
Why Mastercard Doesn't Use OAuth 2.0
1–10 of 56 posts
Re: Why Mastercard Doesn't Use OAuth 2.0
#2This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS.
No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
Re: Why Mastercard Doesn't Use OAuth 2.0
#3It looks like they are concerned that OAuth 2.0 doesn't include a cryptographic signature of the request body, as seen in OAuth 1.0.
My understanding is that OAuth 2.0 dropped that signature in favour of requiring TLS to protect against tampering. I'd be interested to know why Mastercard doesn't consider this to be as good as the request body signatures in OAuth 1.0.
Re: Why Mastercard Doesn't Use OAuth 2.0
#4I'm not sure I understand the concern with integrity of OAuth 2.0 payloads. Sending the request over HTTPS already ensures that the request is not tampered with, and also guards against replay attacks.
Re: Why Mastercard Doesn't Use OAuth 2.0
#5It looks like they are concerned that OAuth 2.0 doesn't include a cryptographic signature of the request body, as seen in OAuth 1.0. My understanding is that OAuth 2.0 dropped that signature in favour of requiring TLS to protect against tampering. I'd be interested to know why Mastercard doesn't consider this to be as good as the request body signatures in OAuth 1.0.
From a technical PoV, it feels like it is easier to argue after the fact "look, you sent this message, you signed it", v.s. "trust us, all comms were over TLS, we promise our logs are accurate and your token was not leaked".
Re: Why Mastercard Doesn't Use OAuth 2.0
#6I'm not sure I understand the concern with integrity of OAuth 2.0 payloads. Sending the request over HTTPS already ensures that the request is not tampered with, and also guards against replay attacks.
Wouldn't this be a reasonable reason if you consider that they might use additional equipment to terminate HTTPS connection in an early layer of their network?
Re: Why Mastercard Doesn't Use OAuth 2.0
#7This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS. No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
They (quasi-implicitly) say that a design goal of their system is "message level security", and stress the desire for "non-repudiation", which is not provided by TLS per se.
Re: Why Mastercard Doesn't Use OAuth 2.0
#8It looks like they are concerned that OAuth 2.0 doesn't include a cryptographic signature of the request body, as seen in OAuth 1.0. My understanding is that OAuth 2.0 dropped that signature in favour of requiring TLS to protect against tampering. I'd be interested to know why Mastercard doesn't consider this to be as good as the request body signatures in OAuth 1.0.
It's quite common for companies to MITM https requests (and install their personal certificate on all company owned machines so the browser raises no errors).
Some countries do so as well, for example Kazakhstan and China.
Re: Why Mastercard Doesn't Use OAuth 2.0
#9This author doesn't seem to understand basic security. OAuth1a doesn't protect from "account takeover / impersonation attacks". OAuth1a just signs requests while OAuth2 delegates that to TLS. No matter how secure the lock, someone gets the keys to the house (account takeover) they can open the door.
This[0] paper argues that "OAuth 2.0 is intrinsically vulnerable to App impersonation attack due to its provision of multiple authorization flows and token types."
[0] Application Impersonation: Problems of OAuth and API Design in Online Social Networks
Re: Why Mastercard Doesn't Use OAuth 2.0
#10It looks like they are concerned that OAuth 2.0 doesn't include a cryptographic signature of the request body, as seen in OAuth 1.0. My understanding is that OAuth 2.0 dropped that signature in favour of requiring TLS to protect against tampering. I'd be interested to know why Mastercard doesn't consider this to be as good as the request body signatures in OAuth 1.0.
It's quite common for companies to MITM https requests (and install their personal certificate on all company owned machines so the browser raises no errors). Some countries do so as well, for example Kazakhstan and China.
And people from that country have those certificates installed? Voluntarily?