Application Security Weekly Subscribe

Application security, DevSecOps, IAM Technologies

OAuth, WebAuthn, and the Impact of Design Choices – Dan Moore – ASW #260

October 23, 2023

We return to discussions of OAuth and all sorts of authentication. This time around we're looking at the design of authentication protocols, the kinds of trade-offs they weigh for adoption and security, and how a standard evolves over time to keep pace with new attacks and put to rest old mistakes.

Segment resources:

Full episode and show notes

Guest

Principal Product Engineer at FusionAuth

Dan Moore is a principal product engineer for FusionAuth, and currently helps build solutions and educate developers about auth and OAuth. He’s written, contributed to or edited 5 books, including “Letters To a New Developer” and “97 Things Every Cloud Engineer Should Know”. A former CTO, technical trainer, engineering manager and longtime developer, Dan has been writing software for (checks watch) over 25 years.

Hosts

Tech Lead at Block

Senior Engineering Leader at AWS

Related

Application security

Skype Hangs Up, Android Backdoors, Jailbreak Research, Pretend AirTags, Wallbleed – ASW #321

March 11, 2025

Skype hangs up for good, over a million cheap Android devices may be backdoored, parallels between jailbreak research and XSS, impersonating AirTags, network reconnaissance via a memory disclosure vuln in the GFW, and more!

Application security

CISA’s Secure by Design Principles, Pledge, and Progress – Jack Cable – ASW #321

March 11, 2025

Just three months into 2025 and we already have several hundred CVEs for XSS and SQL injection. Appsec has known about these vulns since the late 90s. Common defenses have been known since the early 2000s. Jack Cable talks about CISA's Secure by Design principles and how they're trying to refocus businesses on addressing vuln classes and prioritizi...

Application security

QR Codes Replacing SMS, MS Pulls VSCode Extension, Threat Modeling, Bybit Hack – ASW #320

March 4, 2025

Google replacing SMS with QR codes for authentication, MS pulls a VSCode extension due to red flags, threat modeling with TRAIL, threat modeling the Bybit hack, malicious models and malicious AMIs, and more!