FBI again warns of Kali365 phishing service targeting Microsoft 365 accounts

itnerd.blog

3 pointsmooreds2 comments

" The device code grant exists for legitimate reasons; I wouldn’t want to type a password into my printer or smart TV when I could use my phone."

i really shouldnt have to use a password to use my printer or my TV, but that spits out a, i really shouldnt have to connect my printer or TV to the internet to use it.

using a third device to authorize login to the second device, initiated by first device acting upon a webpage.

who is it that thinks this is secure access?

I mean, the device code grant was codified by the IETF in 2019[0]. That is no guarantee that it is 100% secure, but folks have spent time working to make it as safe as possible. There's also a Best Current Practice (BCP) doc[1] and if you have suggestions to improve the flow, they'd be welcomed.

0: https://datatracker.ietf.org/doc/html/rfc8628

1: https://datatracker.ietf.org/doc/draft-ietf-oauth-cross-devi...

Reply on news.ycombinator.com