Aaron Parecki

Ō̴̡̨͍͕̠̹̘͖͓̭̝̰̖͉̬̫͍̝̰̟͖͖̞͇̟̻̫͇̠̯̋̋̂ͅͅA̷̡̧͎̫̬͖̠͍̼̗̠͊̉̏̓̈́̂̀̈́͆͘͜uth @oktadev 🎥 livestreaming 💛 #indieweb 🐘🦋

[Aaron Parecki @aaronpk]

@tweetsbycolin That's why Resource Indicators (RFC8707) is called out in the Protected Resource Metadata spec (RFC9728) https://t.co/7rswuuf3Pj

[Aaron Parecki @aaronpk]

@levie If you want to avoid your users having to click through a bunch of OAuth consent screens when connecting all these data sources, give this a read and get in touch https://t.co/ORxsblYJck

[Aaron Parecki @aaronpk]

@tweetsbycolin @zeeg Yes, it's been there forever, but rarely used. There's also step-up auth RFC 9470, not about scope, but about other attributes https://t.co/wZ00n8zuFR

[Aaron Parecki @aaronpk]

@tweetsbycolin Hey there, sorry I was out of town last week and didn't see this until now! I have some ideas for how to improve this, what's the best way to discuss?

[Aaron Parecki @aaronpk]

@samuelgoto @Paul_Kinlan @mfosterio oh I bet the browser is blocking it. If you've ever clicked the little X it blocks it from working until you go unblock it. Go to this page and I bet you'll see "automatically blocked third-party sign-in" chrome://settings/content

[Aaron Parecki @aaronpk]

@samuelgoto @anderspitman Let me poke around a bit. I've also got some interest in the IdP registration API internally.

[Aaron Parecki @aaronpk]

@samuelgoto Yeah, I've been following that, and think it's a great idea. If that ships, I would then 100% recommend people use a BFF to manage OAuth tokens and a device-bound cookie to their BFF. https://t.co/GZy34yxXUZ

[Aaron Parecki @aaronpk]

@samuelgoto We've tried to capture the state of storage in the browser in the OAuth Browser Apps BCP https://t.co/cQgvjGPTug

[Aaron Parecki @aaronpk]

@samuelgoto Yes this is still a gap. Non-exportable WebCrypto keys are a good start, since you can use them to sign access token requests using DPoP, making token exfiltration less of a problem.

[Aaron Parecki @aaronpk]

@__b_c I lost my API key in The Purge™

[Aaron Parecki @aaronpk]

@vibronet @idr_labs wow I got 50% masculine and 28% feminine, I wonder what the rest is

[Aaron Parecki @aaronpk]

@SoundSpeedsYT @notshenetworks That'd be a pretty good deal if you can pull it off

[Aaron Parecki @aaronpk]

@thoward37 @dotnetfringe or ML4ALL makes a comeback as AI4ALL? 😅

[Aaron Parecki @aaronpk]

@ottokruse That's the TLDR. The longer version is explaining the intricacies in how the implicit flow relates to OpenID Connect and all the combinations of response types and response modes

[Aaron Parecki @aaronpk]

@vibronet I absolutely agree, the problem is certain platforms *ahem* still haven't fully made the switch

[Aaron Parecki @aaronpk]

@dpchiesa Sounds a lot like advertising/marketing too. I suppose that's true with everything.

[Aaron Parecki @aaronpk]

@jakesloaninak tbh go look at the comments from large channels on related videos that you'd do and see what the viewer community is like.

I should have done that before I made that Remote ID video because 😬😬😬 notice how I haven't posted another video about that since 😬

[Aaron Parecki @aaronpk]

@saradietschy The last good GoPros for live video! 😅

[Aaron Parecki @aaronpk]

@EposVox omg me too definitely don't look at my older videos 🙈

I eventually gave up and use straight out of camera colors for everything now