Sender Constrained Token - Revision history

Tom: /* References */

2019-12-18T20:40:32Z

‎References

Tom: /* References */

2019-12-18T20:37:11Z

‎References

Tom: /* Problems */

2019-12-18T20:35:42Z

‎Problems

Tom: /* Context */

2019-12-18T20:31:07Z

‎Context

Tom at 20:30, 18 December 2019

2019-12-18T20:30:35Z

Tom: /* Context */

2019-12-18T20:27:36Z

‎Context

Tom at 19:46, 18 December 2019

2019-12-18T19:46:33Z

Tom: Created page with "==Full Title or Meme== A Sender Constrained Token can be considered to be a token there the Subject presenting the token can prove possession of some credential that i..."

2019-12-18T19:45:10Z

Created page with "==Full Title or Meme== A Sender Constrained Token can be considered to be a token there the Subject presenting the token can prove possession of some credential that i..."

New page

==Full Title or Meme==
A [[Sender Constrained Token]] can be considered to be a token there the [[Subject]] presenting the token can prove possession of some credential that is bound to the token.
==Context==
* [[Bearer Token]]s have proven to be susceptible to reuse by unauthorized parties.
==Problems==
==Solutions==
==References==

[[Category:Authorization]]

@@ Line 14: / Line 14: @@
 ==References==
-[[Category:Glossary]
+[[Category:Glossary]]
 [[Category:Authorization]]

← Older revision		Revision as of 20:37, 18 December 2019
Line 14:		Line 14:
	==References==		==References==

		+	[[Category:Glossary]
	[[Category:Authorization]]		[[Category:Authorization]]

@@ Line 7: / Line 7: @@
 * [[Bearer Token]]s have proven to be susceptible to reuse by unauthorized parties.
 * The most commonly accessed protected resource is [[User Private Information]], which has had low value in the view of the web sites heretofore.
+* On 2019-12-09, 1 & 1 Telecommunications was fined €9.55 million ($10.6 million) by Germany's Federal Commissioner for Data Protection and Freedom of Information, or BfDI, for its failure to put in place "sufficient technical and organizational measures" to protect customer data in its call center environments.<ref>Matthew Schwartz, ''GDPR Violation: German Privacy Regulator Fines 1&1 Telecom'' (2019-12-09) Bank Info Security. https://www.bankinfosecurity.com/gdpr-breach-german-privacy-regulator-fines-11-telecom-a-13482</ref> Perhaps it is time to increase security of user data?
 ==Solutions==

@@ Line 2: / Line 2: @@
 A [[Sender Constrained Token]] can be considered to be a token there the [[Subject]] presenting the token can prove possession of some credential that is bound to the token.
 ==Context==
 * In common [[OpenID Connect]] code flows, the response to the user's consent is used by the relying party (confusingly called the user's client) to request an access_token (which is typically a [[Bearer Token]]) and a refresh_token (which is typically a [[Sender Constrained Token]].