Subject: [oauth] Comment on charter

From: Lisa Dusseault <[email-masked]>
Date: Fri, 6 Feb 2009 11:04:45 -0800

Here's a comment on the charter, Greg told me this in person but I asked him
to follow up on the list.  He's not on the list, so please keep him on the
cc' for this discussion:

Oauth team,
I think the work you are doing is meaningful and I hope to see it transition
to WG soon.

Here is a comment to your charter that I made from the mic at the last BoF,
and which I hope to see included in the next version of the charter.

>From the charter:

"The Working Group will produce one or more documents suitable
for
consideration as Proposed Standard, based upon the OAuth I-D, that will:
  * Align OAuth with the Internet and Web architectures, best
practices and
terminology
  * Assure good security practice, or document gaps in its
capabilities
  * Promote interoperability"

Change second bullet to:
"* Assure good security practice, or document gaps in its
capabilities, and propose a path forward for addressing the gap."

The reason:  we have experienced in other places in IETF where
documents with less-than-perfect security get hung up in Security Area
review, and for good reason. We want secure protocols that use modern,
best-practice secruity mechanisms. However, sometimes getting from today
to that state of best-practice security mechanism is non-trivial, and
will take standard and implementation work. We are learning over time
that (1) documenting security gaps, combined with (2) a clear path to
addressing gaps, and (3) work in progress to addressing gaps goes a long
way to making less-than-best-security-practice specifications more
acceptable.

I.e. The charter change I propose is geared toward helping Oauth see the
light of day more quickly, and have an incremental path toward
best-practice security.

Let me know what you think,
Gregorry.

---

From: Blaine Cook <[email-masked]>
Date: Sun, 8 Feb 2009 14:59:15 +0100

On Fri, Feb 6, 2009 at 8:04 PM, Lisa Dusseault <[email-masked]> wrote:
> ...
> ... We are learning over time

I fully agree. My approach to security, and I think this is true for
others involved with OAuth, is to strive for the best security that
will actually work. That is to say that if OAuth wasn't adopted
because the security introduced a too-high barrier to adoption, then
the reality is that everyone has less security overall since they're
using Basic auth or whatever other (less secure) alternative.

By pushing forward OAuth, we've educated people and informed
discussions around security, enabling people to think about even
better approaches, and as those conversations mature, we (as the web
community in general) should absolutely be active in ensuring that we
offer the best usable solutions possible.

b.

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Tue, 17 Feb 2009 10:37:00 +0200

Thank you Greg for your input. I incorporated your comment into the
charter text as it sounds good to me. 
 
Ciao
Hannes

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of ext Lisa Dusseault
	Sent: 06 February, 2009 21:05
	To: [email-masked]
	Cc: [email-masked]
	Subject: [oauth] Comment on charter

	Here's a comment on the charter, Greg told me this in person but
I asked him to follow up on the list.  He's not on the list, so please
keep him on the cc' for this discussion:

	Oauth team,
	I think the work you are doing is meaningful and I hope to see
it transition to WG soon. 
	
	Here is a comment to your charter that I made from the mic at
the last BoF, and which I hope to see included in the next version of
the charter.
	
	From the charter:
	
	consideration as Proposed Standard, based upon the OAuth I-D,
that will:
	
	Change second bullet to:
	"* Assure good security practice, or document gaps in its
	capabilities, and propose a path forward for addressing the
gap."
	
	The reason:  we have experienced in other places in IETF where
	documents with less-than-perfect security get hung up in
Security Area
	review, and for good reason. We want secure protocols that use
modern,
	best-practice secruity mechanisms. However, sometimes getting
from today
	to that state of best-practice security mechanism is
non-trivial, and
	will take standard and implementation work. We are learning over
time
	that (1) documenting security gaps, combined with (2) a clear
path to
	addressing gaps, and (3) work in progress to addressing gaps
goes a long
	way to making less-than-best-security-practice specifications
more
	acceptable. 
	
	I.e. The charter change I propose is geared toward helping Oauth
see the
	light of day more quickly, and have an incremental path toward
	best-practice security.