OAuth
Internet protocolWikipedia
404
MENTIONS
152
EPISODES
121
PODCASTS
Search complete. 404 mentions across 152 episodes found for "OAuth".
Sep 11, 2026
speaker_0HOST
This update features an interactive onboarding walkthrough, support for populating workspaces from bare repositories, and cleaner syncing between your local Git branches and Looker development mode.
speaker_0HOST
Security is also improved with OAuth support for the Curo IDE and highly secure storage of API client secrets.
speaker_0HOST
And for those using the legacy mobile app, the deprecation of the Looker mobile legacy application has been postponed to January 31st, 2027.
speaker_0HOST
So you have a little more runway to migrate to the standard non-legacy Looker mobile app.
Jenna GaidusekHOST
And so I did.
Jenna GaidusekHOST
And now they're like, oh, well, here's your OAuth right inside of your stuff.
Jenna GaidusekHOST
It's all built in.
Jenna GaidusekHOST
I'm like, oh, cool.
AndreHOST
with Strava app.
AndreHOST
So like the Garmin syncs to Strava and then Strava allows you to build OAuth based apps
speaker_2UNKNOWN
for
AndreHOST
Strava.
speaker_1HOST
Security operation centers monitor those oath consent grants very closely, because malicious apps constantly try to trick users into approving them.
speaker_1HOST
But this AI-designed toolkit avoided the OAuth flow entirely.
speaker_0HOST
How? If it didn't ask for permission, how did it get the tokens?
speaker_1HOST
By going directly to the operating system's memory.
ThanosHOST
Okay.
Michael RollinsHOST
But I guess the point being is like you can actually control that from the Gmail dashboard, from the OAuth credentials.
ThanosHOST
Well, no.
ThanosHOST
Yes, with Gmail you can, but not all products give you fine green access controls.
James MaudHOST
We have, you know, all these things that are now starting to appear that weren't in our vocabulary a few years ago around MCPs and things like that.
James MaudHOST
And I know you've discussed the challenges with MCP vendors not always following their own OAuth spec.
James MaudHOST
So could you elaborate on that and explain to listeners what the challenge is there with these MCP vendors?
Jeffrey MattsonGUEST
Yeah, well, I think probably your audience would understand what MCP is.
James MaudHOST
Yeah, I think a lot of people don't realize that, I think there was a study earlier in the year that said around 40% of remote MCP servers ship with zero authentication.
James MaudHOST
The ones that have some level will often handle credentials in plain text.
James MaudHOST
A small fraction still follow the OAuth flows, but actually when the servers are meant to validate that every token was issued for them and bind it to an aeroscope and never pass it through to an upstream service.
James MaudHOST
in practice, they don't actually implement all these things that people expect.
Robert LuceroGUEST
Authentication and who you are or what you are and authorization still are the core concepts.
Robert LuceroGUEST
We're lucky to have Aaron Parecki here at Okta who helps guide us in terms of like how we think about this within the industry space and has helped us with the OAuth spec and with MCPs.
Robert LuceroGUEST
And I think that that conversation continues to come up.
Robert LuceroGUEST
And now when you have, what I sort of see is, Agents are continuing to be similar to service accounts.
Stephen BancroftHOST
He's got his own email address.
Stephen BancroftHOST
He's OAuthed into G Drive and Gmail.
Stephen BancroftHOST
He can send emails.
Stephen BancroftHOST
He can do the whole box and dice.
KildareGUEST
Yeah, plus
ZinGUEST
we support a single sign-on, so Apple ID, Google, OAuth, which all need to be added.
TomGUEST
We are doing our best to do it, but I'll be frank, there is concerns for account security.
TomGUEST
Like one of the things that people mention is, oh, just Mac.
Matt J.HOST
Like this evil NGINX is like a proxy that you can host another company's Okta login on your domain.
Matt J.HOST
uh steal the creds through it and it also helps the evil engine x has tools built into it to help uh grab two factor and like replay two factor stuff through it as well they're very very very very good at this part okay they like blast the company with this fake login page they get a few successes that's all they need uh they grab an octa sso login and and they're in and if you guys have ever used octa you log in it's just a bunch of sas you know portals and the one login just gets you access to all of that they at machine speed pass the oauth tokens off of all they click everything instantly and they they get all the oauth tokens they pass them to their team they have a team of people ready for this success to actually occur And they have people specialized in certain SaaS services to start exfiltrating data from that OAuth token that they get to different parts of the world.
Matt J.HOST
So you can't even really do a lot of the geo stuff that you're meant to do.
Matt J.HOST
They're very, very good.
142 more episodes mention OAuth.
Create an account to see the whole feed, search across every transcript, and follow the entities you care about.