|
|
|
|
|
|
by zigzag312
34 days ago
|
|
|
Can you share source of this data? I have my doubts about the quality of the data, since OAuth2 is such a complex system with so many footguns. In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used. I bet we can generalize to say that data shows that you will likely fail to properly secure any secret (including the ones used in OAuth2). EDIT: An example: https://news.ycombinator.com/item?id=37973937 |
|
|
> In the 2025 report, we showed that nearly 70% of credentials confirmed as valid in 2022 were still valid as of January 2025, meaning they have not been rotated or otherwise remediated. When we retested the same dataset in January 2026, the validity rate remained over 64%. That persistence is not a rounding error. It is an operational signal that remediation, not detection, is still the industry’s limiting factor.
> In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used.
Obviously. The point here is to reduce the number of them