Main complaints around Self-Sovereign Identity fiasco that I have is that it is at best “Self-sovereign Identifier”. You will see it if you read the W3C community group draft. When we define “identity” as “set of attributes related to an entity”, just being able to claim a “name/nym” as one’s own …
The hype and hysteria around blockchain, blockchain identity and Facebook/Cambridge Analytica scandal have been quite interesting to watch. It did and is still showing a lot about people’s understanding of the space, which is actually a bit different than what I think. For example, people think that they own their …
I just came across with Don Tapscott’s TED Talk titled “How the blockchain is changing money and business” . In it, he talks about 5 potential use cases of blockchain technology that may result in transformations for a prosperous world. They are: Protecting rights through immutable records, e.g., land title. In many places …
Here is the slide I used in API Days Paris 2016, for the Banking track. Direct link to slideshare: http://www.slideshare.net/nat_sakimura/financial-grade-oauth-openid-connect Hope they are useful.
Here is the presentation file that I used for my 10 minutes OpenID Foundattion Financial API WG presentation at the Open Data in Finance Conference ( June 15, 2016). To join the Working Group, please sign the IPR Contribution agreement online by clicking here or download the PDF form and fill it, scan …
Here is the script of the Chair’s remark at the opening of the Open Data in Fianance Conference in London (June 15, 2016) 09:00 – 09:10 Chair’s Welcome Nat SakimuraSenior ResearcherNomura Research Institute Hello. Welcome to the Open Data in Finance Conference. I am really excited to be a part …
I have many bank accounts. If I wanted to use a new and shiny graphing service, I have to get authorization from each banks individually. That’s a bit of nuisance. Instead of doing that, if I can instruct each banks to delegate authorization on my accounts to my Authorization server, …
Code phishing attack is the attack that the adversary obtains the code and client credentials from the legitimate client and uses them against the honest token endpoint to obtain tokens thereby accessing the protected resources illegitimately. Assumptions There are not much assumptions needed for this attack. The client and the server …
2015 was a hectic year: Bunch of the specs that I have been working on (JWS [RFC7515], JWT [RFC7519], OAuth PKCE [RFC7636], JWK Thumbprint [RFC7638]）got published and the work to convert ISO/IEC 29100 Privacy Framework into Japan Industry Standard started. We had OpenID Summit Tokyo 2015 gathering around 500 audience also. (The last time was back …
Just came across this article: Apple CORED: Boffins reveal password-killer 0-days for iOS and OS X, by The Register. Since the news itself did not explain the nature of the attack well enough, I went onto reading the full paper: Xing, Bai, Li, Wang, Chen, Liao: “Unauthorized Cross-App Resource Access on …
![Code phishing attack on OAuth 2.0 [RFC6749]](https://i0.wp.com/nat.sakimura.org/wp-content/uploads/2016/01/code_token_phishing.png?resize=430%2C350&ssl=1)
