Subject: [OAUTH-WG] OAuth in the news again....

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 01 Dec 2014 17:25:13 +0100

Hi all,

I fear we have to write another article to clarify what OAuth does and
what it does not do based on the misinformation spread with this recent
article:
http://www.techopedia.com/definition/26694/oauth

A quote from that article:
"
Graham Williams, a Vancouver-based technology expert, points to what is
known as an "open authentication protocol" — or OAuth — where people
often unwittingly share personal information with third-party websites.
"

Ciao
Hannes

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 1 Dec 2014 11:42:40 -0500

Hi Hannes,

When something is written up and agreed upon, I'd recommend that we
tweet about it in force to get the writeup some attention in an effort
to help prevent this in the future.  I could blog about it in the IESG
blogs too if helpful.

On Mon, Dec 1, 2014 at 11:25 AM, Hannes Tschofenig
<[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 

Best regards,
Kathleen

---

From: Bill Mills <[email-masked]>
Date: Mon, 1 Dec 2014 17:03:02 +0000 (UTC)

that link does not contain the quoted text.  Also the quoted text isn't wrong when you look at the FB OAuth usage and how users actually use it. 

     On Monday, December 1, 2014 8:42 AM, Kathleen Moriarty <[email-masked]> wrote:

 Hi Hannes,

-- 

Best regards,
Kathleen

---

From: John Bradley <[email-masked]>
Date: Mon, 1 Dec 2014 14:51:46 -0300

Hannes,

I think this may be the link you were trying to share.
http://www.cbc.ca/m/touch/news/story/1.2844953

I suspect the problem was the profile ID leaking via a ad rather than anything to do with OAuth
as she never logged in.  

John B.

> On Dec 1, 2014, at 1:25 PM, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
>

---

From: Phil Hunt <[email-masked]>
Date: Mon, 1 Dec 2014 10:33:59 -0800

One thing to think about is that often people are talking in different ways about the same thing. E.g. in the article, people are talking about authentication as a service, where as in the IETF we talk about authentication as a protocol.

Mike, Tony, and I ran into this when we named the draft “User Authentication for Clients”.  What we recognized was that at a protocol level, OAuth is being used to pass session information to a client. UA4C doesn’t do authentication but passes parameters and session information.  When we talked about UA4C in the OAuth WG we got caught up (wrongly) in whether OAuth WG even has a mandate that includes authentication. Yet, “authentication service” is all over OAuth (directly and indirectly - e.g. client authentication vs user authen). Developers use OAuth as a service because it depends on authentication of all parties (Users, clients, and service providers, and endpoints).

Yet, in naming the draft we had to address the idea that what client developers want is access to a User authentication “service” which is how they view OAuth.

The difference between authentication as a “service” vs. “protocol” is subtle but seems important.  I’m not sure if this is the thread that can explain the difference to the common IETF contributor and developer communities — otherwise, I’d be all over it.

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 1, 2014, at 8:42 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hi Hannes,
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 01 Dec 2014 19:58:08 +0100

Yes, this is the story. Sorry for including the wrong link.

We can find out what the issue was but that wasn't necessarily my point.

The problem is that there is unfortunately little understanding about
the different layers and responsibilities involved. I think there is
something to write about and I will compile a first draft.

Ciao
Hannes

---

From: Nat Sakimura <[email-masked]>
Date: Tue, 02 Dec 2014 00:35:49 +0000

The article is mislead in multiple ways. At its heart, it has nothing to do
with the OAuth but the problem of explicit consent model, that people are
trained to click "accept". Apparently, she did give her authorization to
pull her profile to create Zoosk account. She did the on-the-fly
provisioning to Zoosk, but this was "without her knowledge" because she
clicked "accept" without reading. This is where consent receipt type of
idea becomes more helpful.

Cheers,

Nat

---

From: Bill Mills <[email-masked]>
Date: Tue, 2 Dec 2014 00:51:38 +0000 (UTC)

Mis-stated perhaps, but it's highlighting a core problem we punt on at the protocol layer.  FB as the example here tries to make teh friction of using a FB login as low as possible, and so the user consent stuff is dialed down to the very minimum of acceptable.  This is the common pattern, get a user consent and you're covered legally and then the drive is to make that consent as minimally invasive (read effective) as possible.

---

From: Nat Sakimura <[email-masked]>
Date: Tue, 02 Dec 2014 01:02:44 +0000

Indeed, and there are commercial incentives for it.
I have doubts about the legal effectiveness of such consent but that is the
de-facto situation right now.
On the longer run, there are initiatives like information sharing and
consent WG at Kantara and ISO/IEC SC 27/WG 5 study group on notice and
consent which hopefully would emerge with a better model but that only
helps the future and not now.

Do you have some suggestions to help the situation in the mean time?

On Tue Dec 02 2014 at 9:51:39 Bill Mills <[email-masked]> wrote:

> Mis-stated perhaps, but it's highlighting a core problem we punt on at the
> protocol layer.  FB as the example here tries to make teh friction of using
> a FB login as low as possible, and so the user consent stuff is dialed down
> to the very minimum of acceptable.  This is the common pattern, get a user
> consent and you're covered legally and then the drive is to make that
> consent as minimally invasive (read effective) as possible.
>

---

From: Bill Mills <[email-masked]>
Date: Tue, 2 Dec 2014 01:05:11 +0000 (UTC)

I think the motion here is going to be social/legal and not standards based.  We can preach on this all we want, but in the end folks like the EFF and major privacy watchdogs will carry the water here. 

     On Monday, December 1, 2014 5:02 PM, Nat Sakimura <[email-masked]> wrote:

 Indeed, and there are commercial incentives for it. 
I have doubts about the legal effectiveness of such consent but that is the de-facto situation right now. On the longer run, there are initiatives like information sharing and consent WG at Kantara and ISO/IEC SC 27/WG 5 study group on notice and consent which hopefully would emerge with a better model but that only helps the future and not now. 
Do you have some suggestions to help the situation in the mean time? 
On Tue Dec 02 2014 at 9:51:39 Bill Mills <[email-masked]> wrote: