Dinsdag 22 September 2020

Download EA Cricket 2007 For Pc Full Version

Download Cricket 2007 For Free

Cricket 2007 Full Review

Welcome to Cricket 2007 is one of the best sports game especially for cricket lovers that has been developed HB Studios and published by Electronic Arts. This game was released on 14th November 2006. 


How to install cricket 2007


Screenshot

System Requirements Of Cricket 07 Download Free

Before you start World Of Cricket 07 Download free make sure your PC meets minimums system requirements.
  • Tested on Window 7 64 Bit
  • Operating System: Window XP/ Vista/ Window 7/ Window 8 and 8.1/10
  • CPU: 2.0 GHz Intel Pentium 4 or later
  • RAM: 512 MB
  • Setup size: 1.1 GB
  • Hard Disk Space: 1.5 GB

Cricket 07 Download Free

Click on below button to open google drive. It is full and complete game. Just download and start playing it we have provided direct link full free setup of the game.







Maandag 21 September 2020

The Seven Habits Of Highly Effective People Part 1: Summary Of The 25Th Anniversary Edition

INTRODUCTION: WHY 7 HABITS?

This will be a long post, as I'll be summarizing Stephen Covey's The Seven Habits of Highly Effective People through the first 3 Habits. The last 4 Habits will be covered in a separate post to be more "organized".

After using self-compassion, I noticeably felt better. I recall in this past post,
that I tried reading Stephen Covey's The Seven Habits of Highly Effective People, but couldn't even do the first exercise due to fatigue. But now that I'm in a much better place, I decided to go through the book again.

I completed the entire book when I had way more energy in College, and really found it eye-opening and helpful. However, the lessons didn't stick, otherwise, I would've remembered and continued with these habits to this day.


These habits can be very difficult to follow as it takes a lot of due diligence, willpower to not do what you want in the moment, but to work on what you find worthy, meaningful and important.


You can feel demoralized as you continue to slide back into bad habits. You may even feel negatively towards yourself, and feeling like a failure for not being an "effective" person.


That's why it's absolutely imperative that you practice self-compassion. There are going to be many days where you'd rather sleep in and not exercise, and you may berate yourself.


However, if you're kind to yourself, you'll validate these universal feelings, indeed, animals tend to use the least amount of energy, evolutionary speaking! We try to conserve energy in the face of scarcity.


Using self-compassion, you will then say, but I'm a truly worthy person, so I'll commit to exercising after work. You can walk up and down the stairs for 10 mins, or walk around the house for 10 mins as alternative. Some movement is better than none!


Therefore, if you didn't do the one habit that would make an enormous difference in your life, with self-compassion on your side, you'll just pick yourself up and do light exercise later on in the day!


Carl Rogers noted that having unconditional positive regard is the key to change, and an important ingredient in making things work for you. 


Additionally, you must have energy. When I was exhausted, I couldn't accomplish anything. So exercise, getting a good night's sleep, eating fruits and vegetables, and so forth can help with energy.


Why follow the 7 Habits in the first place? Because of Covey's work, future self-help books base their principles on his work - namely, one book will be on empathic listening, another on synergy, and so forth.


Further, I found the book not only profound but practical, as it outlines steps that can help you reach your goals, in a principled manner. Covey gives you exercises to act on these positive habits.


Through these exercises, you will find what you value, not what society, family and friends say you should be. Then, the book helps you to live in line with your own truths, again in a principled way.


Again, do these habits with self-compassion, recognizing that it's very hard work. Even Covey mentioned that it's difficult in his Foreword to the 2004 edition. He writes, "I have personally found living the 7 Habits a constant struggle...Because I sincerely work and struggle every day at living these principle-embodied habits, I warmly join you in this adventure" (p. 20). And this is the man who wrote the book!


Because of self-compassion and seeing ourselves as worthy, we want to live with integrity and principle. After all, we don't treat our precious things with contempt and carelessness, but rather with care. Likewise, when we value ourselves, we want to take care of ourselves, we want to be happy and pursue purpose and meaning in our lives, in a principled way.


I'm summarizing the 7 Habits as I find it's in sore need of an update for people of diverse backgrounds. It appears that Covey is writing to the upper white middle class families. Even so, "don't throw the baby out with the bath water", but rather focus on the principles of what Covey is expounding.

FOREWARD TO THE 25th ANNIVERSARY EDITION

In this Foreword, Covey acknowledges that our problems and pain are universal, and solutions will be based upon universal, timeless, self-evident principles

These principled solutions stand in contrast to common thinking of modern society as outlined below.


BODY:

Cultural tendency: continue with unhealthy lifestyle habits; treat health problems with surgery and medication.

Principle: prevent diseases and problems by incorporating healthy life choices. Such as the tried and true sleep hygiene, eating healthy, exercising, meditation, preventive medical checkups, and so forth.


MIND:

Cultural tendency: watch television, "entertain me"

Principle: read broadly and deeply, continuous education


HEART:

Cultural tendency: use relationships with others to advance your personal, selfish interests

Principle: deep, respectful listening, helping and serving others brings greatest fulfillment and joy.


I found the above compelling because when people think about being an "effective" person, they think you need to manipulate and use others to get ahead of the game, seek and gain power and money to abuse others to get what you want and need.


This book proposes the exact opposite, that by following principles of honor and integrity to the best of your abilities, it can help solve painful problems, bringing you joy and contentment, as it aligns with universal truths.


Instead of using and abusing others, Covey calls for having utmost respect, listening and understanding others deeply, without judgment. By doing this, you move toward empowering not just the person, but yourself.


INSIDE-OUT AND OVERVIEW

The Seven Habits of Highly Effective People focuses on Character Ethic as a way to be an effective person. You must start first with your self, with your paradigms, your character and your motives.

For Covey, Character Ethic is the foundation of success - you can only experience enduring happiness when you integrate these principles.


The major principles are:

  • Fairness
  • Integrity and Honesty
  • Human Dignity
  • Service
  • Quality or Excellence
  • Potential/Growth
  • Patience, Nurturance and Encouragement
By following these principles, you're following the correct roadmap. You may falter, but you can always consult the map and find your way back - there's always opportunities to do so to exercise these principles!

Following is a great description of a person who fell off the map and got lost, not using principles as a guide post, in the words of Erich Fromm:
Today, we come across an individual who behaves like an automaton, who does not know or understand himself, and the only person that he knows is the person that he is supposed to be, whose meaningless chatter has replaced communicative speech, whose synthetic smile has replaced genuine laughter, and whose sense of dull despair has taken the place of genuine pain. Two statements may be said concerning this individual. One is that he suffers from defects of spontaneity and individuality which may seem to be incurable. At the same time, it may be said of him he does not differ essentially from the millions of the rest of us who walk upon this earth.
I appreciate this quote, because this is what we all go through, and suffer, being a universal condition. However, we can change course by steering ourselves toward universal principles.

Do these principles make sense? They do, if we look at the negative of these timeless principles.

Being unfair, judgmental, deceptive, manipulative, not wanting to "git gud" (gamer terminology), being nasty and impatient to others - this doesn't lead to success in the truest sense.

Malignant narcissists, who have those negative qualities, can be extremely successful financially, often ending up as CEOs. Because they'd do anything to get ahead, they can cut corners and make quick gains, pushing their way to the glass ceiling. But they're very miserable, having no meaningful, loving relationships or connections with anyone.

Please be advised that human beings and all mammals are hard-wired to have connection with one another. We're social animals. When we're cut off or don't have a sense of belonging, that brings about true suffering.

But being fair, open, honest, improving upon yourself, encouraging and helping others - these things make people happy and able to connect with others in a fulfilling way.

Some of the negative habits to combat:
  • procrastination
  • impatience
  • criticalness
  • selfishness
Procrastination definitely makes you less effective. What's interesting is that the last 3 negative habits lead to disconnect from others. What this book is steering us toward is to have positive connections with others to be successful.

The book explains how you can achieve principled habits, but of course, have self-compassion if you go back to bad habits. Covey admits that having good habits involve tremendous process and commitment.

Covey notes that habits are the intersection of knowledge, skill and desire:

Knowledge is the theory and paradigms of what to do.
Skill is how to do it.
Desire is you want to do it.

The 7 Habits are incremental and integrated approach to developing personal and interpersonal effectiveness. As you go through the habits, you move from dependence to independence, and finally to interdependence.

When we reach interdependence, we can combine our talents and abilities and create something greater together, compared to independently, achieving more success and becoming more effective together. Two heads are better than one.

When you share yourself deeply, meaningfully with others, you may have access to the vast resources and potential of other human beings.

Habits 1 to 3 help you move from dependence to independence. This is your Private Victory.

Habits 4 to 7 help you move from independence to interdependence. This is your Public Victory.

Although you need to achieve independence before you gain interdependence - you have to learn how to crawl before you walk - it may take many years, even a lifetime to "master" habits 1 to 3. However, you can also work on habits 4 to 7 concurrently!

HABIT 1 - BE PRO-ACTIVE

Being proactive means that you take responsibility for your own life. Our behavior is a function of our decisions, not our conditions.

Reactive people are often effected by their physical environment. If the weather is good, they feel good. If the weather is bad, they feel bad.


However, a proactive person carries their own weather with them. Whether it rains or shine, doesn't matter, because proactive people are value driven, and their value is to produce good quality work, being kind to others, and so forth, regardless of what's going on.


Covey mentions the proactivity of Victor Frankl, Holocaust survivor, who founded Logotherapy, and author of Man's Search For Meaning, which I wrote about here.


Despite the atrocities, Frankl chose how he acts, and found meaning in the suffering, and helped others to find their own meaning.


We all can't be Frankl. Indeed, if one of my hair strands is out of place, I feel that I can't stream as well. However, we can start slowly and have minor victories when we act positively rather than reacting. 


Suppose it's raining outside, and as a result your arthritis is really acting up. You can chose to stay at home and be in pain and miserable. Or you can have compassion and acknowledge your pain. Then you may problem-solve, give a middle finger to the crappy weather, and go out with your friends. 



Covey uses the model of circle of influence - those are the things you have control over, such as being patient, kind and understanding. Around the circle of influence, you have circle of concern, which you don't have control over such as the weather, politics and such. 

When you're proactive, you use your energy in working on your circle of influence, instead of reacting negatively to things you can't control, and then blaming others for your problems.


You have direct control by working on your habits, such as the Private Victories of Habits 1, 2, 3. Indirect control problems are solved by changing our methods of influence - Public Victories of Habits 4, 5, 6. No control problems can be dealt with accepting the way things are, even though we don't like it.


Here's an example on how you can expand your circle of influence, by working on yourself and how you respond.


Your boss tends to be critical of others, but doesn't have a verifiable DSM-V personality disorder, so you can work with her. Instead of complaining about yet another mistake she pointed out, you start trying to understand her and what she's looking for. 


Instead of avoiding her at all costs, or just saying "yes" to whatever she says to "get her off my back", you instead truly listen to what she wants and expects. Actually, she may be taken aback if she sees you actively searching out her advice when you have a question about the project, since she notices that people avoid her like the plague.


Because you truly understand what her vision is and you're able to implement it as a result, she will be impressed, and come to you for more of the "plum" projects.


You're clearly proactive in this situation. Instead of blaming her for being "bitchy" and saying, "if only she were more understanding, my work would be better", you decide to understand exactly what she wants, getting all the specifics so you can easily implement.


However, your other coworkers start getting jealous, one actually calls you a "brown noser" to your face. Instead of reacting, you have the wherewithal to tell him that you're not brown nosing, you're just following these particular steps that she finds useful and that's how you can "get ahead". By giving him these valuable tips, he can take it or leave it.


If he's "not convinced", you continue to make positive overtures toward him. Seeing that you're actually genuine and authentic, he starts using your tips, noticing that they actually work, and you gained an ally. 


The other coworkers eventually follow suit. You turned an unpleasant work experience into a positive one.


Now the issue here is if your boss actually has a verifiable personality disorder. She completely belittles and insults others, lies about her employees to cover herself, fires employees indiscriminately, and creates a truly toxic environment. 


You have a family to feed, so you can't quit your job, even though your wife and children are begging you to leave for your health.


However, even in this dire situation, you can be proactive. Take notes whenever she says something demeaning to you or another person. Make sure you write down the exact day and time this occurs. If you have good reflexes, you can also record the toxicity on your smartphone.


On the weekends, you and your wife scour the internet for job opportunities. If you get fired, you can hire a lawyer, armed with scores of exceptionally detailed notes, which is every lawyer's wet dream for a lawsuit.


If you manage to not get fired, once you find another job, you can put in your 2 weeks notice.


How can you tell if you're proactive or not? If you're reactive you use "have" statements. If you're proactive, you use "be" statements.


Reactive statements examples:

  • I'll be happy when I have my house paid off...
  • If only had a boss who wasn't such a dictator (use the techniques above instead)...
  • If I had more obedient kids...
  • If I had my degree...
  • If I could just have more time to myself...
Proactive statements examples:
  • I can be more patient
  • I can be more wise
  • I can be more understanding
  • I can be more resourceful
  • I can be more diligent
The Application Suggestions are:
  1. For a full day, listen to your language and to the language of the people around you. How often do you use and hear reactive phrases such as "If only," "I can't", or "I have to".
  2. Identify an experience that have behaved reactively. How could you respond proactively. Create this experience vividly in you mind, picturing yourself responding in a proactive manner. 
  3. Select a problem from work or personal life that is frustrating to you. Determine whether it's direct, indirect, or no control problem. Identify the first step you can take in your Circle of Influence to solve it and then take that step.
  4. Try the 30-day test of proactivity. Be aware of the change in your Circle of Influence.
HABIT 2: BEGIN WITH THE END IN MIND

The following exercise will help define what you find truly valuable in your life.

Imagine yourself at a funeral, the whole procession. What would you want your loved ones (family and friends) and coworkers to say about you during your eulogy?


Those will be your values and what you consider important.


When I tried that exercise, I wanted people to say some positive things that I'm not. One is "she's someone who honors commitments" but I tend to cancel social engagements.


Therefore, through this funeral exercise, I know I need to work on only making promises that I can truly keep and really following through, as one of my core principles.


The other interesting thing is that nowhere in the eulogy did I want someone to say that "she valued her freedom" because that sounds "bad". However, when I really looked deep into myself, choosing only three things I value most, they are: 

  1. Freedom
  2. Love
  3. Growth
The last two showed up in the eulogy, but my most valued, Freedom, did not. Even so, I find that I can't be authentic if I don't have freedom.

Therefore, do the eulogy, which is crucial, but in a separate list, find three things that make you happy.

A lot of us, in the happiness list, would put down being wealthy. As studies show, materialism doesn't lead to happiness, so being wealthy isn't your value.

Instead, write down why you want to be wealthy. What comes up mostly is you want money so you can travel, eat amazing foods, go to concerts and experience other unique activities and events.

Therefore, I would say that you value rich experiences, and that could be something you can work toward. 

It's important to come up with your unique mission statement. It will change as you consider things more, as you get older, as you go through different milestones in life, and such. But at least you have a blue print as to what you're aiming for.

Do the funeral exercise - it can be rather eye-opening to see where your values really lie.

Next, with this "End in Mind", you want to focus on what you want to be (character), and to do (contributions and achievements), and put that in your life mission statement.

Since this funeral exercise is so open-ended, as well as mission statements being equally open-ended, and I struggle in pinning things down, the Franklin Covey mission statement builder was quite helpful. 

I would do the funeral exercise, and then the mission statement builder.

Once armed with this knowledge, you have your own blueprint as to how you want to live your life, not how others perceive you.

You want to make sure that you follow your vision and values, which is your Circle of Influence, and the more you work, the more your Circle of Influence expands. That's where you want to focus your attention on.

You want a Principled Center. By focusing our lives on correct principles, we create a solid foundation, that doesn't fluctuate based on people or things that constantly change, and are quite fickle. 

Alternative Centers
Covey next lists alternative centers that we tend to have, rather than a Principled Center. These are spouse, family, money, work, possession, pleasure, friend/enemy, church/institution and self-centeredness.

Let's take work-centeredness as an example of why not having a Principled Center is problematic. When you're work-centered, your personal worth is determined by your occupation. You're only comfortable when you're working. You make your decisions based on the needs and expectations of work. You tend to be limited by your work role. You see your work as your life. 

The other alternative centers are equally problematic. But having a principled center, you aren't being acted upon by other people or circumstances, rather you make your decision based on looking at the whole picture, factoring in work, family and other needs to come up with the best solution.

Covey gives a good example of an alternative center versus principled center approach. Your husband was looking forward to this concert for the past month or so. But at the night of the concert, your employer calls you to do some prep work for tomorrow's 9 AM meeting.

If you're spouse-centered, you go to the concert with your husband. Or you may feel you have to work instead, but very anxious about his response, justifying your decision and protecting yourself from his disappointment,

If you're money-centered, you'd call your husband to cancel the concert b/c this could lead to a potential raise. 

Covey goes down the other alternative-centered options which we won't outline here, but the principled-centered option makes the most sense.

A possible outcome using the principle-centered approach is to communicate to your husband and boss, whom you both have a strong connection. You genuinely want to prepare for this meeting because you value your boss's effectiveness and you want to contribute to the team (proactive) rather than staying at work to get the edge on someone else (reactive).

You want to go to the concert with your husband because you both were committed to this for the past month or so, and this is your husband's favorite band growing up. 

You chose what is ultimately most valuable to you in your mission statement, which happens to be your relationship with your husband, when you did your eulogy.

Therefore, you tell your boss that you'll come in early in the morning to prepare for the meeting because you care about the welfare of the team, and go to the concert with hubby.

Application suggestions:
  1. Record funeral impressions.
  2. Write down your roles.
  3. Begin work on your personal statement, this tool can help.
  4. Circle all the alternate centers that you tend to follow
  5. Start a collection of notes, quotes and ideas you may want to use as resource material for your mission statement
  6. Identify a project you'll face, and envision how to solve this using a principled center approach.
  7. Share the principles of Habit 2 to loved ones and/or work group, and suggest that together, being the process of a family and/or group mission statement.
HABIT 3: PUT FIRST THINGS FIRST
The answers to these questions will direct you during Habit 3.

Question 1: What one thing could you do (something you aren't doing now) that, if you did it regularly, would make a tremendous positive difference in your personal life?

Question 2: What one thing in your business or professional life would bring similar results?

For the first question, I came up with 3: going to bed and getting up at the same time, exercising, and eating more fruits and vegetables. For the second question, being more organized by using to-do lists.

Covey poses that Habit 3 is the practical fulfillment of Habits 1 and 2.

Habit 1 says, "You're in charge". It challenges you to realize, "that's an unhealthy program I've been given from my childhood, from my social mirror. I don't like that wrong script, I can change it".

Habit 2 shows us what's most important to us.

Habit 3 is the exercise that you do to become principle-centered, and how you carry out what's most important to you. Covey describes a time management matrix.


Quadrant 1 are important and urgent such as crises, pressing problems, deadlines.

Quadrant 2 is important but not urgent.

Quadrant 3 are non-important but urgent such as interruptions, some calls, some mail, some meetings.

Quadrant 4 are not important and not urgent such as trivia, time-wasters.

Write down all of your roles, such as personal, parent, spouse, employee and for each one, write down the essentials such for each of these roles - that will most likely be Quadrant 1, 2 and 3 concerns. Exercise would fall under your personal role, Quadrant 2.

If you, like most families, work multiple jobs, and you find that you don't have time to have dinner with your children (I would say this is a very basic Quadrant 2 issue), look again at your roles list. Delegate any Quadrant 3. 

If still pinched for time, look at your roles again, weeding out the unimportant positions. If you see one as being PTA member, then I'd quit, since your values are with your children (Habit 2).

If work is getting in the way, then cut unnecessary expenses to reduce work hours. I often see families struggling to make ends meet (leading to multiple jobs). Come to find out I see their children (as young as 5-years old) with the latest, largest iPhone ($1,500), when all they really need is clamshell for emergencies ($30). 

In other words, resist the urge to keep up with the Joneses. It's not worth working multiple jobs for all these unnecessary luxury items.

Here's an example that often comes up:

A mother brings in her daughter ("Jill") as she's severely depressed. Jill is concerned about her mother because she works too many hours, and her health is declining as a result. Further, they can't spend time together, which Jill says also makes her depressed. She spends her time alone in her room while her mother works. If that's not depressing, I don't know what is.

It was obvious that their relationship is their most-valued principle (Habit 2), so Quadrant II is working on their relationship.

When I asked the mother why she's working full-time and then Uber after work and on weekends, she reports that she has to pay bills (Quadrant 1 Urgent) and buy things for Jill to make her happy (allegedly Quadrant 2).

Jill then mentions that she doesn't even want these things, which include the mother paying for Jill and her friends to go out to eat, hair extensions, fancy manicures, smartphones, and so forth. We calculated that it comes to $1000/month. Uber = $8/hr, so that's 31.5 hours/week.

Since Jill convinced the mother that she'd rather spend the time with her, foregoing the luxuries, the mother agreed to quit Uber altogether and keep the full-time job. 

Jill went even further and agreed to do almost all the chores (Quadrant III), so that they both can spend even more time together, which is their Quadrant II, most important values.


I saw them 2 weeks later and Jill was beaming with joy - so not only did her depression go away completely, but she's very happy having all these special moments with her mother.

In other words, cut out the crap and focus on what's meaningful to you.

Click here for Part II - Public Victories.

The How of Happiness Review

Saterdag 12 September 2020

Panzerjager And APC Back In Stock!

Helllooooo Ladies...
 
 
We received a restock on our OOS Panzerjäger and Kielerkopf APC kits!
 
 
 

Now through April 30th we are also offering a 35% off sale on select kits...

 
 
We are waiting on some packaging to arrive to fill in other OOS products such as 15mm Leviathan arms.
 

We will be releasing two new kits shortly, 15mm scale capacitor coolers and a large scale Valkir Assault Trooper for all you painters and collectors out there. Stay toned for more info....

 
 
 
 
 
 
 

Fallout 4 VR Free Download

Fallout 4, the legendary post-apocalyptic adventure from Bethesda Game Studios and winner of more than 200 'Best Of' awards, including the DICE and BAFTA Game of the Year, finally comes in its entirety to VR. Fallout 4 VR includes the complete core game with all-new combat, crafting, and building systems fully reimagined for virtual reality. The freedom of exploring the wasteland comes alive like never before.

As the sole survivor of Vault 111, you enter a world destroyed by nuclear war. Every second is a fight for survival, and every choice is yours. Only you can rebuild and determine the fate of the Wasteland. Welcome home.
GAMEPLAY AND SCREENSHOTS :

DOWNLOAD GAME:

♢ Click or choose only one button below to download this game.
♢ View detailed instructions for downloading and installing the game here.
♢ Use 7-Zip to extract RAR, ZIP and ISO files. Install PowerISO to mount ISO files.


Fallout 4 VR Free Download
http://pasted.co/af29b5ae

INSTRUCTIONS FOR THIS GAME
➤ Download the game by clicking on the button link provided above.
➤ Download the game on the host site and turn off your Antivirus or Windows Defender to avoid errors.
➤ Once the download has been finished or completed, locate or go to that file.
➤ To open .iso file, use PowerISO and run the setup as admin then install the game on your PC.
➤ Once the installation process is complete, run the game's exe as admin and you can now play the game.
➤ Congratulations! You can now play this game for free on your PC.
➤ Note: If you like this video game, please buy it and support the developers of this game.

SYSTEM REQUIREMENTS:
(Your PC must at least have the equivalent or higher specs in order to run this game.)


Minimum:
• OS: Windows 7/8.1/10 (64-bit versions)
• Processor: CPU: Intel Core i5-4590 or AMD FX 8350 or better
• Memory: 8 GB RAM
• Graphics: Nvidia GeForce GTX 1070 / AMD RX Vega 56 or better
• Storage: 30 GB available space

Recommended:
• OS: Windows 7/8.1/10 (64-bit versions)
• Processor: CPU: Intel Core i7-6700K or AMD Ryzen 5 1600X
• Memory: 16 GB RAM
• Graphics: Nvidia GeForce GTX 1080 / AMD RX Vega 64
• Storage: 30 GB available space
Supported Language: English, Italian, Spanish, Polish, Russian, Portuguese-Brazil, Simplified Chinese language are available.
If you have any questions or encountered broken links, please do not hesitate to comment below. :D

Vrydag 04 September 2020

Suzy Cube Update: June 1, 2018

#SuzyCube #gamedev #indiedev #madewithunity @NoodlecakeGames 
What a week!! We are continuing to work hard to wrap things up in time for *redacted*. 
Read more »

Sondag 30 Augustus 2020

PKCE: What Can(Not) Be Protected


This post is about PKCE [RFC7636], a protection mechanism for OAuth and OpenIDConnect designed for public clients to detect the authorization code interception attack.
At the beginning of our research, we wrongly believed that PKCE protects mobile and native apps from the so called „App Impersonation" attacks. Considering our ideas and after a short discussion with the authors of the PKCE specification, we found out that PKCE does not address this issue.
In other words, the protection of PKCE can be bypassed on public clients (mobile and native apps) by using a maliciously acting app.

OAuth Code Flow


In Figure 1, we briefly introduce how the OAuth flow works on mobile apps and show show the reason why we do need PKCE.
In our example the user has two apps installed on the mobile phone: an Honest App and an Evil App. We assume that the Evil App is able to register the same handler as the Honest App and thus intercept messages sent to the Honest App. If you are more interested in this issue, you can find more information here [1].

Figure 1: An example of the "authorization code interception" attack on mobile devices. 

Step 1: A user starts the Honest App and initiates the authentication via OpenID Connect or the authorization via OAuth. Consequentially, the Honest App generates an Auth Request containing the OpenID Connect/OAuth parameters: client_id, state, redirect_uri, scope, authorization_grant, nonce, …. 
Step 2: The Browser is called and the Auth Request is sent to the Authorization Server (usually Facebook, Google, …).
  • The Honest App could use a Web View browser. However, the current specification clearly advice to use the operating system's default browser and avoid the usage of Web Views [2]. In addition, Google does not allow the usage of Web View browser since August 2016 [3].
Step 3: We asume that the user is authenticated and he authorizes the access to the requested resources. As a result, the Auth Response containing the code is sent back to the browser.

Step 4: Now, the browser calls the Honest App registered handler. However, the Evil App is registered on this handler too and receives the code.

Step 5: The Evil App sends the stolen code to the Authorization Server and receives the corresponding access_token in step 6. Now, the Evil App can access the authorized ressources.
  • Optionally, in step 5 the App can authenticate on the Authorization Server via client_id, client_secret. Since, Apps are public clients they do not have any protection mechanisms regarding the storage of this information. Thus, an attacker can easy get this information and add it to the Evil App.

    Proof Key for Code Exchange - PKCE (RFC 7636)

    Now, let's see how PKCE does prevent the attack. The basic idea of PKCE is to bind the Auth Request in Step 1 to the code redemption in Step 5. In other words, only the app generated the Auth Request is able to redeem the generated code.


    Figure 2: PKCE - RFC 7636 

    Step 1: The Auth Request is generated as previosly described. Additionally, two parameters are added:
    • The Honest App generates a random string called code_verifier
    • The Honest App computes the code_challenge=SHA-256(code_verifier)
    • The Honest App specifies the challenge_method=SHA256

    Step 2: The Authorization Server receives the Auth Request and binds the code to the received code_challenge and challenge_method.
    • Later in Step 5, the Authorzation Server expects to receive the code_verifier. By comparing the SHA-256(code_verifier) value with the recieved code_challenge, the Authorization Server verifies that the sender of the Auth Request ist the same as the sender of the code.
    Step 3-4: The code leaks again to the Evil App.

    Step 5: Now, Evil App must send the code_verifier together with the code. Unfortunatelly, the App does not have it and is not able to compute it. Thus, it cannot redeem the code.

     PKCE Bypass via App Impersonation

    Again, PKCE binds the Auth Request to the coderedemption.
    The question rises, if an Evil App can build its own Auth Request with its own code_verifier, code_challenge and challenge_method.The short answer is – yes, it can.

    Figure 3: Bypassing PKCE via the App Impersonation attack
    Step 1: The Evil App generates an Auth Request. The Auth Request contains the client_id and redirect_uri of the Honest App. Thus, the User and the Authorization Server cannot recognize that the Evil App initiates this request. 

    Step 2-4: These steps do not deviate from the previous description in Figure 2.

    Step 5: In Step 5 the Evil App sends the code_verifier used for the computation of the code_challenge. Thus, the stolen code can be successfully redeemed and the Evil App receives the access_token and id_token.

    OAuth 2.0 for Native Apps

    The attack cannot be prevented by PKCE. However, the IETF working group is currently working on a Draft describing recommendations for using OAuth 2.0 for native apps.

    References

    Vladislav Mladenov
    Christian Mainka (@CheariX)

    Related articles