<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.4.1">Jekyll</generator><link href="https://danielfett.de/feed.xml" rel="self" type="application/atom+xml" /><link href="https://danielfett.de/" rel="alternate" type="text/html" /><updated>2026-01-24T10:02:32+00:00</updated><id>https://danielfett.de/feed.xml</id><title type="html">danielfett.de</title><author><name>Daniel Fett</name></author><entry><title type="html">Cross-Device Session Fixation and how the DC API solves it</title><link href="https://danielfett.de/2025/03/10/cross-device-session-fixation/" rel="alternate" type="text/html" title="Cross-Device Session Fixation and how the DC API solves it" /><published>2025-03-10T00:00:00+00:00</published><updated>2025-03-10T00:00:00+00:00</updated><id>https://danielfett.de/2025/03/10/cross-device-session-fixation</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[In the context of digitial credential ecosystems and specifically the EU Digitial Identity (EUDI) Wallet, there have been discussions recently whether to adopt the W3C Digital Credentials API (DC API) or not. While the API promises various improvements (e.g., wallet selection) and brings drawbacks in other areas, it is important to understand a specific type of security issue that can only be solved by an integration with the browser and operating system as provided by the DC API. In this post, I’ll describe the problem and discuss potential mitigations.]]></summary></entry><entry><title type="html">Improving OAuth App-to-App Security</title><link href="https://danielfett.de/2020/11/27/improving-app2app/" rel="alternate" type="text/html" title="Improving OAuth App-to-App Security" /><published>2020-11-27T00:00:00+00:00</published><updated>2020-11-27T00:00:00+00:00</updated><id>https://danielfett.de/2020/11/27/improving-app2app</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[By Fabian Hauck (yes.com), Joseph Heenan (Authlete), Daniel Fett (yes.com) OAuth flows on mobile devices can benefit a lot from native apps. With native apps, for example, it is possible to use already existing sessions and biometric authentication features. While apps improve the user experience, they also bring new security challenges to OAuth, especially for services like open banking. This document describes the challenges of redirections between native apps and web applications on Android and iOS and recommends solutions based on currently available features of the mobile operating systems and browsers. Our recommendations are more detailed than those from RFC8252 (OAuth 2.0 for Native Apps) and also address use cases with very high security requirements. A pull request for the AppAuth-Android project has been created.]]></summary></entry><entry><title type="html">Finding and Fixing TLS Misconfigurations with TLS Profiler</title><link href="https://danielfett.de/2020/05/22/open-source-tls-scanner/" rel="alternate" type="text/html" title="Finding and Fixing TLS Misconfigurations with TLS Profiler" /><published>2020-05-22T00:00:00+00:00</published><updated>2020-05-22T00:00:00+00:00</updated><id>https://danielfett.de/2020/05/22/open-source-tls-scanner</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[To secure data in transport for web services and web sites, TLS is indispensable. But just enabling TLS is not enough: Several different TLS versions and many dozens of options exist for their usage, and it is very hard to tell which combinations are secure and which are not, and which are compatible with certain browsers and devices. In this howto, I introduce TLS Profiler, a new open source tool to scan for TLS misconfigurations.]]></summary></entry><entry><title type="html">PKCE vs. Nonce: Equivalent or Not?</title><link href="https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/" rel="alternate" type="text/html" title="PKCE vs. Nonce: Equivalent or Not?" /><published>2020-05-16T00:00:00+00:00</published><updated>2020-05-16T00:00:00+00:00</updated><id>https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[Traditionally, the state parameter is used to provide protection against Cross-Site Request Forgery (CSRF) attacks on OAuth. The newer mechanisms PKCE (RFC7636) and the OpenID Connect parameter nonce not only protect against CSRF, but they also provide some level of protection against Code Injection attacks. In this document, I evaluate (informally) the differences in the provided protection levels of state, PKCE, and Nonce against CSRF and misuse of stolen codes.]]></summary></entry><entry><title type="html">DPoP Attacker Model</title><link href="https://danielfett.de/2020/05/04/dpop-attacker-model/" rel="alternate" type="text/html" title="DPoP Attacker Model" /><published>2020-05-04T00:00:00+00:00</published><updated>2020-05-04T00:00:00+00:00</updated><id>https://danielfett.de/2020/05/04/dpop-attacker-model</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[This document outlines attacker models considered for DPoP.]]></summary></entry><entry><title type="html">Mix-Up, Revisited</title><link href="https://danielfett.de/2020/05/04/mix-up-revisited/" rel="alternate" type="text/html" title="Mix-Up, Revisited" /><published>2020-05-04T00:00:00+00:00</published><updated>2020-05-04T00:00:00+00:00</updated><id>https://danielfett.de/2020/05/04/mix-up-revisited</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[A Mix-Up Attack on OAuth is an attack wherein the attacker manages to convince the client to send credentials (authorization code or access token) obtained from an “honest” authorization server to a server under the attacker’s control. In this analysis, I revisit simple mix-up attacks and mix-up attacks with OAuth Metadata and try to find out what happens if we put Pushed Authorization Requests (PAR) into the mix.]]></summary></entry><entry><title type="html">New OAuth Security Recommendations</title><link href="https://danielfett.de/2019/03/04/new-oauth-security-recommendations/" rel="alternate" type="text/html" title="New OAuth Security Recommendations" /><published>2019-03-04T00:00:00+00:00</published><updated>2019-03-04T00:00:00+00:00</updated><id>https://danielfett.de/2019/03/04/new-oauth-security-recommendations</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[The OAuth Security BCP contains a number of new and updated recommendations on the usage of OAuth 2.0. I recommend reading the whole document to understand the threats and attacks that lead to these guidelines. As a quick reference, the following table shows an overview of the most important new recommendations:]]></summary></entry><entry><title type="html">Writing RFCs with Markdown</title><link href="https://danielfett.de/2019/02/28/writing-rfcs-with-markdown/" rel="alternate" type="text/html" title="Writing RFCs with Markdown" /><published>2019-02-28T00:00:00+00:00</published><updated>2019-02-28T00:00:00+00:00</updated><id>https://danielfett.de/2019/02/28/writing-rfcs-with-markdown</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[RFC7749 defines Version 2 of “xml2rfc”, an XML-based format for authoring RFCs. The xml2rfc v2 format is the preferred format for uploading RFCs to the IETF. There is also the newer Version 3 of xml2rfc, but it is not yet supported for IETF RFCs. (The Version 3 XML still looks similar to Version 2 XML, but supports more features, for example, figures in enumerations.) As far as I can see, there are no good cross-platform editors for xml2rfc that support highlighting, source code formatting, and a preview of the generated files. For markdown, however, all this exists!]]></summary></entry><entry xml:lang="de"><title type="html">Reguläre Ausdrücke</title><link href="https://danielfett.de/2006/03/20/regulaere-ausdruecke-tutorial/" rel="alternate" type="text/html" title="Reguläre Ausdrücke" /><published>2006-03-20T00:00:00+00:00</published><updated>2006-03-20T00:00:00+00:00</updated><id>https://danielfett.de/2006/03/20/regulaere-ausdruecke-tutorial</id><author><name>Daniel Fett</name></author><summary type="html"><![CDATA[Dieser Artikel feiert 2026 sein 20-jähriges Jubiläum und war einer der ersten Beiträge auf meiner Website. Es ist schön zu sehen, dass er sich weiterhin großer Beliebtheit erfreut und daher bleibt er auch noch eine Weile hier. "Reguläre Ausdrücke" sind eine Art Sprache, die beim Programmieren für diverse Problemlösungen verwendet werden kann, insbesondere dann, wenn es darum geht, Zeichenketten (Strings) zu bearbeiten, zu prüfen oder in ihnen etwas zu suchen. Und weil der Name "Reguläre Ausdrücke" etwas unhandlich ist, heißen die "Regular Expressions" auch oft einfach nur "RegEx(en)". Hier gibts ein kleines Tutorial zu diesen esoterisch anmutenden aber unglaublich mächtigen Zeichenketten, die beim unbedarften Betrachter Assoziationen eines kleinen Kindes und dessen ersten Versuchen an der Tastatur auslösen.]]></summary></entry></feed>