Subject: [OAUTH-WG] Secure Client Token Storage

From: Joseph A Holsten <[email-masked]>
Date: Tue, 17 Nov 2009 21:52:50 -0600

If browsers start having OAuth support, they're definitely going to  
need a secure store for those OAuth tokens, so my malicious app  
doesn't just dig through your Firefox config for access to tokens.

This doesn't seem to be mentioned in draft-hammer-oauth-05, §4.7 is  
server specific, and §4.8 only recommends to hide the client  
credentials. Should the spec add a section recommending clients store  
access tokens in secure storage?
--
Joseph Holsten
http://josephholsten.com
mailto:[email-masked]
tel:+1-918-948-6747

---

From: Joseph A Holsten <[email-masked]>
Date: Wed, 18 Nov 2009 02:33:22 -0600

I'm comfortable leaving it implicit if you are. It seems obvious to  
me, I just never know if it's obvious to everyone else who might  
implement.
--
j

Eran Hammer-Lahav supposedly wrote:

> Would you like to propose text?
>
> I think this is application specific. Isn’t calling it a token  
> *secret* enough? :-)
>
> EHL
>
>
> On 11/17/09 7:52 PM, "Joseph A Holsten" <[email-masked]>  
> wrote:
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 17 Nov 2009 22:07:41 -0700

I think this is application specific. Isn't calling it a token *secret* enough? :-)

EHL

On 11/17/09 7:52 PM, "Joseph A Holsten" <[email-masked]> wrote:

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth