The Road To Hell Is Authenticated By Facebook

Egor Homakov hacked Facebook the other day, and while that's interesting all on its own, it's much more interesting as the advance guard of what will surely be a busy season of attacks against sites authenticating with OAuth 2.0.

The hack, which also employs a Chrome bug, allows Homakov to obtain authentication credentials for any client_id the user previously authorized on Facebook. Homakov says:

"Currently I'm discussing and proposing new ways to Facebook security team how to handle it and make response_type=code more secure, because they are the biggest provider and their decisions matter. If we don't fix it - it's The Road To Hell!" His "Road To Hell!" reference doesn't come out of nowhere. It's a reference to the resignation of Eran Hammer, lead OAuth2 project author, from the project. Hammer entitled that resignation "OAuth 2.0 and the Road to Hell."

The OAuth site describes it as "[A]n open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications." It's a method of access delegation, allowing a third party to perform authentication for you. When you go to log into a site and get the option to use your Google or Yahoo or Facebook login instead, that's OAuth in action.

Hammer had been the coordinator of the OAuth 1.0 spec and recognized its limitations:

Because OAuth didn't do what they wanted it to do — it doesn't scale to large, high-volume systems — Yahoo, Microsoft, and Google came up with WRAP (Web Resource Authorization Protocol). Later they deprecated it in favor of OAuth 2.0.

The limitations of OAuth 1.0 were clear to everyone involved, so in 2009 a working group was founded to create OAuth 2.0. But by this point, as Hammer sees it, the establishment took over and turned a sloppy but useful system into a monstrous, complex, and frighteningly insecure one.

Microsoft, Google, Yahoo (MGY), and perhaps some other big sites bent the OAuth standardization process, which was moved into the IETF, to their needs: It's designed for large, hosted sites. It's not designed to work well with mobile clients (remember, this all happened before mobile's centrality was obvious). MGY dominated the standards process, and nobody else showed up to defend other interests.

Of course OAuth 2 claims to be secure, but Hammer says it's all security theater. The main failure comes from the abandonment of digitally signed tokens and uses unsigned "bearer tokens," relying on SSL for security. This excessive faith in SSL leaves the system open to severe attacks that sound suspiciously like the one Homakov reported. The result of these attacks can be theft of credentials, URL hijacking, and malware installation.

[NSFW - Lots of profanity] RealtimeConf - "OAuth 2.0 - Looking Back and Moving On" by Eran Hammer from &yet on Vimeo.

The original imperative of OAuth was to be simple and accessible, but MGY came up with a complex, stateful protocol that also manages to be incompatible with OAuth 1.0. WRAP, and now OAuth 2, essentially bakes the Yahoo Session Extension into the spec, so a generic client has to implement it even if some sites don't require it. It also manages to degrade user experience by forcing users to refresh tokens periodically. The lack of backward-compatibility isn't a secret; the spec announces it to the world:

"1.8. Interoperability

OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own this specification is likely to produce a wide range of noninteroperable implementations.

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full Web-scale interoperability.

"

As you can see in the embedded video above, Hammer has a really bad attitude. He's mad after his OAuth experience and, to the extent that he wants to be part of the solution now, that solution is purely consumer-oriented and tells the enterprise to take all of its interests and use cases and &%*&( %^^^$ *@##@. His new project in this space is OZ.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.