When OAuth 1.0 was invented in the mid-2000's, a native application meant something running on a desktop and websites did not always have APIs. And when they did, you could just replay someone's password to authenticate with HTTP Basic like we always had from the web's early days. But OAuth came and showed the world a better way, and OAuth 2.0 refined that model and cemented the protocol family as the core delegation protocol for nearly everything online. Its core model of connecting one website to another for delegated access has served it well, and OAuth has been successfully extended into related fields like identity (with OpenID Connect) and high assurance (with FAPI).
But now we're 20 years past those early days and the has changed drastically along with every part of life that's now connected to it. Today, machine identities and AI agents are questioning the fundamental model of OAuth in ways we've never seen. OAuth has proven to be incredibly flexible in the past, and new extensions are being proposed to bring it into this new world. At the same time, alternatives have been proposed that have started to take root in some spaces. Are we on the verge of a new world?
Come to this talk to learn about how OAuth is changing, and how our views of security are forcing re-evaluation of contexts and assumptions that have served the internet well for decades.
