token binding killed? (was: Re: Reducing the number of re-authentications)

[Tom Scavo]

On Fri, Mar 29, 2019 at 8:31 AM Etienne Dysli Metref
<etienne.dysli-metref at switch.ch> wrote:
>
> On 08/03/2019 03.12, Cantor, Scott wrote:
> > Token binding was supposed to fix this and then Google all but killed
> > it.
>
> Oh I missed that! What happened?

Token binding is seen (by some) as a hack that covers up the inherent
weaknesses of OAuth2 bearer tokens:
https://tcwiki.azurewebsites.net/index.php?title=Bearer_Tokens_Considered_Harmful

Then Google announced its intent to remove support for token binding in chrome:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/OkdLUyYmY1E

AFAIK, that's where the issue stands today.

Tom