I'm half asleep and not feeling very well today, so please bear that in mind with the following question...

[davep@infosec.exchange]

I'm half asleep and not feeling very well today, so please bear that in mind with the following question...

In the context of a third party Digital Identity provider using PKI, can a phishing site act as a socks proxy (or a plain MitM) for the site that wants authentication, with the third party digital identity provider obviously going direct to the victim because it's a different site (or app), and then just steal the session token once the authentication process is finished?

The point being (possibly) that the PKI gubbins could happen purely with the ID provider. Is there potentially some sort of handshake via the client between the ID provider and the authentication server which stops this? Should I just go and have a nap?

cc: @tychotithonus @atoponce

[davep@infosec.exchange]

Just going through OpenID Connect stuff for the first time in ages but I'm too tired today. Ho hum.

Just a moment...

(hackmag.com)

@tychotithonus @atoponce

[woe2you@beige.party]

@davep It'll take you a fraction of the time when you're not tired and ill.

[peacefulz@infosec.exchange]

@davep

PKCE: link

DPoP: link

This should send you in the right direction. You're correct. PKI alone is vulnerable.

[davep@infosec.exchange]

@Peacefulz Cheers

I'll go through that when I'm less befuddled.

[tychotithonus@infosec.exchange]

@davep

Yeah, my understanding is that if something is in the middle, then unless there's something like WebAuthn (or some other equivalent steps) that enforces binding -- cryptographic validation -- of the actual origin at the far end ... spoofing is possible.

@atoponce