Android Application Question

[Cantor, Scott]

On 1/4/17, 4:20 PM, "users on behalf of Marc Boorshtein" <users-bounces at shibboleth.net on behalf of mboorshtein at gmail.com> wrote:

> So OIDC lets you have a public endpoint that does not require authentication.  This is how the mobile app schemes all
> work.  Otherwise you need to have a secret on every app deployed, which means its not a secret at all.

Right. And I think that's unacceptable, at least until we have TLS token binding or other solutions to elevate security. Which is in fact what they're doing, so it bears (sic) noting that even the people producing this nonsense know it's nonsense.

-- Scott