Subject: [oauth] OAuth Security Advisory

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 23 Apr 2009 22:58:39 -0700

Over the past few days a security threat has been identified in the OAuth Core 1.0 protocol. While this is not an IETF protocol, it is being chartered for standardization within the IETF. Before the security threat has been disclosed, the community has been working closely with many vendors to coordinate and help them mitigate the risks involved. The attack cannot be solved without a protocol change.

The OAuth Security Advisory 2009.1 was posted on the OAuth site:

http://oauth.net/advisories/2009-1

For more information on the attack:

http://www.hueniverse.com/hueniverse/2009/04/explaining-the-oauth-session-fixation-attack.html

I serve as the community coordinator for this issue. Please feel to contact me in public or private with any concerns.

EHL

---

From: "J. Trent Adams" <[email-masked]>
Date: Wed, 29 Apr 2009 13:59:03 -0400

Eran -

I haven't seen much discussion of proposed protocol changes addressing
the recent security advisory on the IETF list.  Do you anticipate that
the work being done on the Google list will eventually migrate over for
review and discussion?

In related news, has anyone notified the IETF Security Directorate,
yet?  It might be a great way to raise the visibility of the issue to
the kind of folks you were hoping to attract to the work.

- Trent

Eran Hammer-Lahav wrote:
> _______________________________________________
> oauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>   

-- 
J. Trent Adams
=jtrentadams

Profile: http://www.mediaslate.org/jtrentadams/
LinkedIN: http://www.linkedin.com/in/jtrentadams
Twitter: http://twitter.com/jtrentadams

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 29 Apr 2009 15:03:42 -0700

This list (IETF) has no "jurisdiction" over the Core 1.0 version which is being addressed on the OAuth public list. Once a solution is proposed, it will be reflected in the draft-hammer-oauth I-D and will be part of the WG discussions.

I did notify the security area but since I am not on their list, not sure if they discussed it or not.

EHL

On 4/29/09 10:59 AM, "J. Trent Adams" <[email-masked]> wrote:

Eran -

- Trent

--
J. Trent Adams
=jtrentadams

---

From: Richard Barnes <[email-masked]>
Date: Wed, 29 Apr 2009 23:23:23 -0400

Sure enough, Eran's message showed up on the SAAG list:
<http://www.ietf.org/mail-archive/web/saag/current/msg02640.html>

There hasn't been any discussion of it on that list so far.

--Richard

Eran Hammer-Lahav wrote:
> This list (IETF) has no “jurisdiction” over the Core 1.0 version which 
> is being addressed on the OAuth public list. Once a solution is 
> proposed, it will be reflected in the draft-hammer-oauth I-D and will 
> be part of the WG discussions.
>
>     > Over the past few days a security threat has been identified in
>     the OAuth Core 1.0 protocol. While this is not an IETF protocol,
>     it is being chartered for standardization within the IETF. Before
>     the security threat has been disclosed, the community has been
>     working closely with many vendors to coordinate and help them
>     mitigate the risks involved. The attack cannot be solved without a
>     protocol change.
>     >
>     > I serve as the community coordinator for this issue. Please feel
>     to contact me in public or private with any concerns.
>     >
>     > EHL
> ------------------------------------------------------------------------
>

---

From: "Thomas Hardjono" <[email-masked]>
Date: Thu, 30 Apr 2009 09:33:26 -0400

Hi Eran,
 
I'm now confused about the OAuth specs being done in the IETF versus the one
being done outside the IETF (Core 1.0):
 
- If in the future further flaws are found in either Core 1.0 or the IETF
draft (or both), what will be the process to fix/reconcile this. Currently
it seems that the real work in being done in the Oauth public list, with the
fixes being brought into draft-hammer-oauth. 
 
(ps. Just a friendly comment: with this approach its going to be difficult
to avoid the impression that the new IETF WG will just be rubber-stamping
the work done outside the IETF. I hope this will not be the case).
 
- Are there plans to converge the two (or deprecate one), and at which point
does the IETF have so-called "jurisdiction".
 
cheers,
 
/thomas/

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Eran Hammer-Lahav
Sent: Wednesday, April 29, 2009 6:04 PM
To: J. Trent Adams
Cc: [email-masked]
Subject: Re: [oauth] OAuth Security Advisory
 
This list (IETF) has no "jurisdiction" over the Core 1.0 version which is
being addressed on the OAuth public list. Once a solution is proposed, it
will be reflected in the draft-hammer-oauth I-D and will be part of the WG
discussions.

I did notify the security area but since I am not on their list, not sure if
they discussed it or not.

EHL

- Trent

Eran Hammer-Lahav wrote:
> Over the past few days a security threat has been identified in the OAuth
Core 1.0 protocol. While this is not an IETF protocol, it is being chartered
for standardization within the IETF. Before the security threat has been
disclosed, the community has been working closely with many vendors to
coordinate and help them mitigate the risks involved. The attack cannot be
solved without a protocol change.
> For more information on the attack:
http://www.hueniverse.com/hueniverse/2009/04/explaining-the-oauth-session-fi
xation-attack.html
>
> I serve as the community coordinator for this issue. Please feel to
contact me in public or private with any concerns.

--
J. Trent Adams
=jtrentadams

---

From: Blaine Cook <[email-masked]>
Date: Thu, 30 Apr 2009 14:42:56 +0100

On Thu, Apr 30, 2009 at 2:33 PM, Thomas Hardjono <[email-masked]> wrote:
> Hi Eran,
>
> I’m now confused about the OAuth specs being done in the IETF versus the one
> does the IETF have so-called “jurisdiction”.

The IETF has not yet formally approved the charter for the OAuth
working group. As such, there isn't any protocol work happening within
the context of the IETF. We expect this to proceed soon.

Once the IETF process starts in earnest, it's hoped that the existing
OAuth community will move discussions entirely to the IETF list and
process.

b.