OAuth and the Long Way to Proof of Possession

This talk traces the history of proof of possession in OAuth 2.0 and explains two approaches to sender-constraining access tokens. It focuses on the security problem of binding tokens to their owners.