Publications - danielfett.de

Publications

2024-10-01 OpenID Foundation Specifications | FAPI 2.0 Attacker Model and Security Profile
Work in Progress
2023-07-01 IETF RFC | SD-JWT Verifiable Credentials
Work in Progress
2022-10-01 IETF RFC | Cross-Device Flows: Security Best Current Practice
Work in Progress
2022-05-01 IETF RFC | Selective Disclosure for JWTs (SD-JWT)
Work in Progress
2022-03-18 IETF RFC | OAuth 2.0 Authorization Server Issuer Identification
RFC9207
2020-03-27 Article @ Heise c't-Magazin 08/2020 | Sicher autorisieren - Wie man OAuth 2.0 richtig verwendet
2019-07-08 IETF RFC | OAuth 2.0 Security Best Current Practice
Work in Progress
2019-07-08 IETF RFC | OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer
RFC9449
2019-03-01 Technical Report | Cross-Browser Payment Initiation Attack
2019-02-01 Paper @ Security & Privacy 2019 | An Extensive Formal Security Analysis of the OpenID Financial-grade API
2018-10-19 PhD Thesis | An Expressive Formal Model of the Web Infrastructure
2017-04-27 Paper @ CSF 2017 | The Web SSO Standard OpenID Connect: In-Depth Formal Security Analysis and Security Guidelines
2016-09-26 Paper @ INFORMATIK 2016 | Pi and More - eine Veranstaltungsreihe rund um "kleine Computer"
2016-01-06 Paper @ CCS 2016 | A Comprehensive Formal Security Analysis of OAuth 2.0
2015-08-07 Paper @ CCS 2015 | SPRESSO: A Secure, Privacy-Respecting Single Sign-On System for the Web
2014-11-26 Paper @ ESORICS 2015 | Analyzing the BrowserID SSO System with Primary Identity Providers Using an Expressive Model of the Web
2014-03-07 Paper @ Security and Privacy 2014 | An Expressive Model for the Web Infrastructure: Definition and Application to the BrowserID SSO System

Articles

2020-11-27 Best Practice | Improving OAuth App-to-App Security
2020-05-22 Howto | Finding and Fixing TLS Misconfigurations with TLS Profiler
2020-05-16 Analysis | PKCE vs. Nonce: Equivalent or Not?
2020-05-04 Analysis | Mix-Up, Revisited
2020-05-04 Analysis | DPoP Attacker Model
2019-03-04 Cheat Sheet | New OAuth Security Recommendations
2019-02-28 Howto | Writing RFCs with Markdown
2006-03-20 Tutorial | Reguläre Ausdrücke

Recent Talks

For my talks and presentations at Pi and More, most of which are in German, see here.

2024-10-29 Internet Identity Workshop 39 | SD-JWT and SD-JWT VC 101
2024-04-01 OAuth Security Workshop 2024 | High-Security and Interoperable OAuth 2: What's the latest? | FAPI 2.0
2023-05-11 EIC 2023 | Current Work and Future Trends in Selective Disclosure
2023-05-09 EIC 2023 | SD-JWT Reference Implementation at the OpenWalletFoundation (OWF)
2022-09-29 Identity, Unlocked | Podcast: Daniel Fett on privacy-preserving measures and SD-JWT
2022-04-26 Internet Identity Workshop 2022 | OpenID Advanced Syntax for Claims
2020-07-14 Identiverse 2020 | Next-Gen Authorization Throwdown: It's Not Your Grandfather's OAuth
2020-06-29 Identiverse 2020 | Identity Assurance with OpenID Connect
2020-01-28 Secure Munich Talks | How (Not) to Use OAuth
2019-12-10 German OWASP Day 2019 | Das Sicherheits-Upgrade für OAuth 2.0
2019-09-24 Secure Cologne Talks | How (Not) to Use OAuth
2019-08-10 Froscon 2019 | How (Not) to Use OAuth
2019-04-17 LocoMocoSec 2019 | How (Not) to Use OAuth
2019-03-20 OAuth Security Workshop 2019 | OAuth Security Reinforced
2016-12-28 33C3 | On the Security and Privacy of Modern Single Sign-On in the Web