Dick Hardt
- Editor of RFC 6749, The OAuth 2.0 Authorization Framework
- Founded Sxip Identity in 2003 and later SignIn.Org and Hellō
- Founding board member of the OpenID Foundation
- Identity 2.0, the 2005 OSCON talk that reframed user-centric identity
Bio
Dick Hardt edited RFC 6749, the OAuth 2.0 Authorization Framework, the document nearly every modern login flow rests on. He founded Sxip Identity in 2003, was a founding board member of the OpenID Foundation, later founded SignIn.Org, and now runs Hellō. Before identity he founded ActiveState. His 2005 Identity 2.0 talk at OSCON is still the reference point for user-centric identity as an argument.
Profile built from public IETF, foundation, and press records.
Where their work shows up
OAuth 2.0 is the closest thing the internet has to a universal delegation primitive, and RFC 6749 is where it is defined. The framework's deliberate flexibility, extension points instead of a single profile, is both why it spread everywhere and why the industry spent the next decade writing security guidance around it, culminating in OAuth 2.1. See OAuth vs OIDC for the distinction his specification is most often cited to settle.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.