Subject: [OAUTH-WG] Preview of -14

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 25 Mar 2011 00:53:10 -0700

https://github.com/hueniverse/draft-ietf-oauth/raw/master/draft-ietf-oauth-v2.txt

This includes all the feedback received until now. My queue is now empty except for the need to propose a new error code extensibility solution to accommodate the needs of protocol extensions.

I replied back to all feedback, and unless your suggestions were purely editorial or accepted in which case I ignored them in my response, I clearly indicated why they were rejected. Feel free to reply back. However, if your request was rejected due to past consensus (or lack of), you should talk to the chairs and try to get the subject back on the WG's agenda.

-14 does not include any normative changes, no new features, and no changes to existing code compliant with -13.

While anything can happen between now and publication as RFC, OAuth 2.0 can be considered done.

I will publish this once the queue is open again.

EHL

---

From: "Freeman, Tim" <[email-masked]>
Date: Sat, 26 Mar 2011 00:16:04 +0000

What's the plan for filling in the security considerations?  In the draft below I see:

>9.  Security Considerations
>
>   [[ TBD ]]

Tim Freeman
Email: [email-masked]<mailto:[email-masked]>
Desk in Palo Alto: (650) 857-2581
Home: (408) 774-1298
Cell: (408) 348-7536

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Friday, March 25, 2011 12:53 AM
To: OAuth WG
Subject: [OAUTH-WG] Preview of -14

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 25 Mar 2011 18:04:27 -0700

Coming right after IETF-80 in -15.

EHL

From: Freeman, Tim [mailto:[email-masked]]
Sent: Friday, March 25, 2011 5:16 PM
To: Eran Hammer-Lahav; OAuth WG
Subject: What's up with the secuity considerations? (was RE: Preview of -14)

Tim Freeman

EHL

---

From: Peter Saint-Andre <[email-masked]>
Date: Sat, 26 Mar 2011 22:00:59 +0100

>>9.  Security Considerations

This might answer some of your questions:

http://tools.ietf.org/html/draft-lodderstedt-oauth-security-01

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Barry Leiba <[email-masked]>
Date: Mon, 28 Mar 2011 04:19:26 -0400

I have also just submitted this draft:
http://tools.ietf.org/html/draft-leiba-oauth-additionalsecurityconsiderations

Hannes has asked me to talk about it for a few minutes in the OAuth
meeting on Friday, and I plan to.

Barry

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 28 Mar 2011 04:36:31 -0400

It appears to me that the first part of the draft is an OAuth tutorial, 
while the last part is written in "shoulds." While a discussion of the 
user interface issues  is interesting, I strongly believe that it is out 
of scope of OAuth.  Other than that, I don't see anything that stands 
out as new or has not been discussed in the past year. 

Specifically, I don't see any references to the work that Torsten and 
Co. have done in the past six months, nor to the discussions that we had 
had on the list.

Given a ridiculously short time we have for the OAuth meeting, I wish 
that we don't spend any of it reinventing the wheel. I would like to see 
any discussion on security SPECIFICALLY reference the existing document 
and address its perceived gaps.

Perhaps Barry could do that in the next three days?

Igor
.

Barry Leiba wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Mar 2011 10:46:37 +0200

Hi Igor, 

the writeup that Barry provided is not meant to be part of the OAuth core draft. Instead, it explores the bigger OAuth security story. 

We certainly do not have an endless amount of time at the face-to-face meeting. 
So, Barry's presentation will be put at the end of the agenda and, if there is time, he could introduce us to the work. 

Ciao
Hannes

On Mar 28, 2011, at 10:36 AM, Igor Faynberg wrote:

> 
> It appears to me that the first part of the draft is an OAuth tutorial, while the last part is written in "shoulds." While a discussion of the user interface issues  is interesting, I strongly believe that it is out of scope of OAuth.  Other than that, I don't see anything that stands out as new or has not been discussed in the past year. 
> Specifically, I don't see any references to the work that Torsten and Co. have done in the past six months, nor to the discussions that we had had on the list.
> 
> Given a ridiculously short time we have for the OAuth meeting, I wish that we don't spend any of it reinventing the wheel. I would like to see any discussion on security SPECIFICALLY reference the existing document and address its perceived gaps.
>

---

From: "Freeman, Tim" <[email-masked]>
Date: Mon, 28 Mar 2011 18:24:21 +0000

It is apparently essential for the security of the protocol that the client state is not guessable by an attacker, as described at:

   http://www.ietf.org/mail-archive/web/oauth/current/msg05733.html

(That link might fail if the mail archive is reindexed.  It's a 23 Mar 2011 email with subject "Protocol breaks if states are guessable".)

Does that belong in the security considerations?

It seems to me it belongs somewhere, unless someone can provide a reasonable argument that it's not true.

Tim Freeman
Email: [email-masked]
Desk in Palo Alto: (650) 857-2581
Home: (408) 774-1298
Cell: (408) 348-7536

-----Original Message-----
From: Barry Leiba [mailto:[email-masked]] 
Sent: Monday, March 28, 2011 1:19 AM
To: Peter Saint-Andre
Cc: Freeman, Tim; OAuth WG
Subject: Re: [OAUTH-WG] What's up with the secuity considerations? (was RE: Preview of -14)

Barry