Even in a mobile app like Skeets, right? (I recall seeing something about Flashes or Skylight users getting logged out all the time…) This seems… super aggressive? 😐 What's the point of this? - ThreadSky

About ThreadSky

mackuba.eu • 24 days ago

Even in a mobile app like Skeets, right? (I recall seeing something about Flashes or Skylight users getting logged out all the time…)

This seems… super aggressive? 😐 What's the point of this?

Comments

mary.my.id•24 days ago

OAuth signifies public clients as unable to securely hold credentials due to XSS and tokens needing to be stored in localStorage.

mary.my.id•24 days ago

both of these seem to be mitigated by DPoP, where it also specifies that its private keys should be configured to be non-exportable though (then the only place you can store it is IndexedDB)

samir.fedica.com•24 days ago

I think that's generally the case with most oAuth2, refresh token with longer TTL and access token with short TTL. Some have token refresh with a simple redirect so the experience is not as jarring

It's a trade off between security and convenience I suppose

mackuba.eu•24 days ago

Yeah but I don't recall hearing about this being a problem in e.g. Twitter/Mastodon iOS apps using OAuth…

mary.my.id•24 days ago

to be fair I think some service implements OAuth weirdly anyway like Mastodon just gives you an access token that doesn't expire IIRC

samir.fedica.com•24 days ago

yeah they don't have refresh tokens .... which is a problem

Also Twitter was oAuth 1 and was working oAuth2 but it was half launched back then, now they are trying to migrate completely but that will take a long time

tom.sherman.is•23 days ago

A mobile app can be a confidential client

mackuba.eu•23 days ago

This would imply that it only can if it has a backend which manages the tokens:

Posting Rules

Be respectful to others
No spam or self-promotion
Stay on topic
Follow Bluesky's terms of service

Comments

Posting Rules

Reply