Subject: [OAUTH-WG] Paper for the W3C Identity in the Browser Workshop about OAuth

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Apr 2011 18:06:28 +0300

Hi guys, 

Barry, Blaine and I compiled a short position paper for the upcoming W3C identity in the browser workshop. 
Here is the call for participation: http://www.tschofenig.priv.at/svn/w3c-browser-identity/

Here is the position paper: 
http://www.tschofenig.priv.at/svn/w3c-browser-identity/oauth.pdf

Let us know if you have some comments. We are happy to incorporate them.  The submission deadline is unfortunately today. This is yet another one of these last minute things, I know. 

Ciao
Hannes

---

From: Paul Madsen <[email-masked]>
Date: Wed, 27 Apr 2011 11:17:43 -0400

'Open Web Authentication protocol'?   authentication?

On 4/27/11 11:06 AM, Hannes Tschofenig wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Dave Nelson <[email-masked]>
Date: Wed, 27 Apr 2011 11:23:21 -0400

Hi Hannes,

One comment immediately in the title.  Isn't OAuth short for Open
Authorization, not Authentication?

Regards,
Dave
David B. Nelson
Sr. Software Architect
Elbrys Networks, Inc.
www.elbrys.com
+1.603.570.2636

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 27 Apr 2011 08:23:33 -0700

It's a relic from the formation of the working group.

I did find it amusing that the paper defines bearer token as a 'cryptographic approach'. I guess no crypto is in its way an approach :-).

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Paul Madsen
> Sent: Wednesday, April 27, 2011 8:18 AM
> To: [email-masked]
> Subject: Re: [OAUTH-WG] Paper for the W3C Identity in the Browser
> Workshop about OAuth
> 
> > Let us know if you have some comments. We are happy to incorporate
> them.  The submission deadline is unfortunately today. This is yet another
> one of these last minute things, I know.
> >
> > Ciao
> > Hannes
> >

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Apr 2011 18:35:57 +0300

In some sense you are right. The problem is just that this is the name of the group :-)
http://datatracker.ietf.org/wg/oauth/charter/

Maybe we should adjust the name with the rechartering process.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 27 Apr 2011 17:38:55 +0200

> Maybe we should adjust the name with the rechartering process.

I think we should.

regards,
Torsten.

---

From: Paul Madsen <[email-masked]>
Date: Wed, 27 Apr 2011 11:40:30 -0400

but you are describing the protocol in the paper, not the group

A reference like 'The Open Web Authentication (OAuth) protocol [1]'

to

[1] E. Hammer-Lahav, D. Recordon, and D. Hardt, “The OAuth 2.0 
Authorization Protocol,”

is going to confuse

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 27 Apr 2011 08:48:25 -0700

This is true. There is no Open Web Authentication protocol. Only a WG.

EHL

> Sent: Wednesday, April 27, 2011 8:41 AM
> To: Hannes Tschofenig
> Cc: [email-masked]
> [1] E. Hammer-Lahav, D. Recordon, and D. Hardt, "The OAuth 2.0
> Authorization Protocol,"
> 
> is going to confuse
> 
> 
> > In some sense you are right. The problem is just that this is the name
> > of the group :-) http://datatracker.ietf.org/wg/oauth/charter/
> >
> >>> Here is the call for participation:
> >>> http://www.tschofenig.priv.at/svn/w3c-browser-identity/
> >>>

---

From: Igor Faynberg <[email-masked]>
Date: Wed, 27 Apr 2011 11:50:24 -0400

Good eye!  (And an excellent point.)

Igor

Paul Madsen wrote:
>>>> Barry, Blaine and I compiled a short position paper for the 
>>>> upcoming W3C identity in the browser workshop.
>>>> them.  The submission deadline is unfortunately today. This is yet 
>>>> another one of these last minute things, I know.
>>>>
>>>> Ciao
>>>> Hannes
>>>>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Apr 2011 19:09:02 +0300

Fixed it. 
Thanks for pointing this out. 

Ciao
Hannes

Ps: Did we miss any technical points that would be useful to bring forward to the Web browser community to improve the security of OAuth?

On Apr 27, 2011, at 6:50 PM, Igor Faynberg wrote:

>> [1] E. Hammer-Lahav, D. Recordon, and D. Hardt, “The OAuth 2.0 Authorization Protocol,”
>> 
>> is going to confuse
>> 
>>

---

From: <[email-masked]>
Date: Wed, 27 Apr 2011 18:09:01 +0200

Hi Hannes,

A) Authentication Mechanisms
Anders Rundgren is a caller in the desert for this for years:
http://webpki.org/
B) Authorization Interface
I think this is the point closest to oauth and that needs the most work.
C) Standardized JavaScript Crypto Library Support
This was discussed e.g. in the NSS group for years
https://www.mozilla.org/projects/security/pki/nss/
If I recollect the most common argument right it was:
"Developers will implement bad security if we give them the basic crypto
building blocks. Combining good crypto A with good crypto B will likely
yield bad crypto C"
D) Moving Crypto Into the Browser
Same comment as for item C. I think your paper should be more specific
to oauth's needs and propose what is needed for oauth and the
(preferrably) ONE way to use the parts.
http://daviddahl.blogspot.com/2011/03/in-which-author-explains-domcrypt-
in.html

I know of one javascript implementation of signed json web tokens in
Firefox. But I think that crypto in javascript is not secure (enough?
Besides speed). 

-Axel

> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Hannes Tschofenig
> Sent: Wednesday, April 27, 2011 5:06 PM
> To: OAuth WG
> Subject: [OAUTH-WG] Paper for the W3C Identity in the Browser 
> Workshop aboutOAuth
> 
> Hi guys, 
> 
> Let us know if you have some comments. We are happy to 
> incorporate them.  The submission deadline is unfortunately 
> today. This is yet another one of these last minute things, I know. 
> 
> Ciao
> Hannes
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 Apr 2011 19:30:28 +0300

> I did find it amusing that the paper defines bearer token as a 'cryptographic approach'. I guess no crypto is in its way an approach :-).

Well. It uses TLS as the underlying primitive. As such, it is a cryptographic mechanism. 
I know that we have different views about the pros & cons of the different approaches. 
Hence the past writeup about this aspect: 
http://tools.ietf.org/html/draft-tschofenig-oauth-signature-thoughts-00

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 27 Apr 2011 21:51:12 +0200

Hi Axel et al.
Thanx for mentioning my WebPKI.org work :-)

I have personally not taken the JS / DOM route because
in the case you have a process that needs to be secured
beyond a single request/response-pair you tend to run
into difficulties combining trusted and untrusted code.

I.e. all my current work-items are similar to HTTPS URLs,
where the browser transfer the URL to trusted code browser
and the rest is performed from there.

I must though confess that I haven't done an extensive research
if for example end-to-end secured provisioning (which is the
by far the most complex project in the collection), actually is
feasible by exposing a bunch of JS APIs.  I did the *assumption*
that it isn't :-|

Microsoft will replace their "APIish" CertEnroll scheme something
"protocolish" based on WS.  In addition to running in trusted
layers you also get XML validation.

My next step is creating an engine for such schemes so that it
becomes easier creating XML browser protocols.

However, David Dahl's DomCrypto looks cool so please don't be
put-off by my non-JS ideas!

Cheers,
Anders