Breaking and Fixing HTTPS Compound Authentication: TLS 1.3, Token Binding, and OAuth 2.0

Although transport layer protocols such as TLS allow client authentication based on strong credentials such as public-key certificates, application protocols such as HTTPS more commonly employ a compound authentication protocol that composes server authentication at the transport layer with user authentication within the application, based on bearer tokens such as passwords or OAuth tokens. We will discuss the strengths and weaknesses of such compound authentication protocols via recent attacks on TLS, HTTPS, and popular websites. We will then see how new protocols such as TLS 1.3 and Token Binding offer a new way of building compound authentication modes for OAuth 2.0 that prevent a large class of credential forwarding attacks.

Lessons from breaking and defending OAuth in practice

Although the risks of bearer token protocols are widely acknowledged by the security community, the adaptability of bearer tokens to different transports has led them, especially OAuth 2.0, to dominate the ecosystem. Published research and the author's own experience have demonstrated repeated weaknesses arising from misuse or missing security properties in a variety of the client-side communication channels employed by these protocols. This talk surveys how flaws and variations in the browser and app platforms implementing these channels further complicate the task of trying to secure popular OAuth 2 implementations and explores several ways large classes of these problems could be significantly mitigated for already deployed systems, at large scale, through improvements at the HTTP protocol level.