Subject: [OAUTH-WG] Call for Adoption: OAuth 2.0 Security: OAuth Open Redirector

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Jan 2016 12:47:44 +0100

Hi all,

this is the call for adoption of OAuth 2.0 Security: OAuth Open
Redirector, see
https://tools.ietf.org/html/draft-bradley-oauth-open-redirector-02

Please let us know by Feb 2nd whether you accept / object to the
adoption of this document as a starting point for work in the OAuth
working group.

Note: At the IETF Yokohama we asked for generic feedback about doing
security work in the OAuth working group and there was very positive
feedback. However, for the adoption call we need to ask for individual
documents. Hence, you need to state your view again.

Ciao
Hannes & Derek

---

From: Antonio Sanso <[email-masked]>
Date: Thu, 21 Jan 2016 06:15:59 +0000

+1 for adoption
On Jan 19, 2016, at 12:47 PM, Hannes Tschofenig <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: William Denniss <[email-masked]>
Date: Thu, 21 Jan 2016 14:18:04 +0800

+1 for adoption.

---

From: John Bradley <[email-masked]>
Date: Thu, 21 Jan 2016 11:08:23 -0300

+1 for adoption

> On Jan 21, 2016, at 3:18 AM, William Denniss <[email-masked]> wrote:
> 
> +1 for adoption.
> 
> On Tue, Jan 19, 2016 at 7:47 PM, Hannes Tschofenig <[email-masked] <mailto:[email-masked]>> wrote:
> Hi all,
> 
> https://tools.ietf.org/html/draft-bradley-oauth-open-redirector-02 <https://tools.ietf.org/html/draft-bradley-oauth-open-redirector-02>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
>

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 21 Jan 2016 14:28:35 +0000

+1 apart from the title... It sounds like the spec is implementing OAuth
Open Redirector...
Something like "preventing OAuth open redirector" or so might be more
descriptive.

Nat

---

From: John Bradley <[email-masked]>
Date: Thu, 21 Jan 2016 11:48:41 -0300

Yes we did discuss changing the title as part of adopting it.

> On Jan 21, 2016, at 11:28 AM, Nat Sakimura <[email-masked]> wrote:
> 
> +1 apart from the title... It sounds like the spec is implementing OAuth Open Redirector... 
> Something like "preventing OAuth open redirector" or so might be more descriptive. 
> 
> Nat
> 
> 2016年1月21日(木) 23:08 John Bradley <[email-masked] <mailto:[email-masked]>>:
> +1 for adoption
> 
>> On Jan 21, 2016, at 3:18 AM, William Denniss <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> +1 for adoption.
>>

---

From: Brian Campbell <[email-masked]>
Date: Thu, 21 Jan 2016 10:34:42 -0700

+1

---

From: George Fletcher <[email-masked]>
Date: Thu, 21 Jan 2016 13:34:36 -0500

+1

On 1/21/16 12:34 PM, Brian Campbell wrote:
> +1
>
> On Thu, Jan 21, 2016 at 7:48 AM, John Bradley <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>>     On Jan 21, 2016, at 11:28 AM, Nat Sakimura <[email-masked]
>>     <mailto:[email-masked]>> wrote:
>>
>>>         On Jan 21, 2016, at 3:18 AM, William Denniss
>>>         <[email-masked] <mailto:[email-masked]>> wrote:
>>>
>>>         +1 for adoption.
>>>
>>>         On Tue, Jan 19, 2016 at 7:47 PM, Hannes Tschofenig
>>>         <[email-masked]
>>>         <mailto:[email-masked]>> wrote:
>>>
>>>             Hi all,
>>>

-- 
Chief Architect
Identity Services Engineering     Work: [email-masked]
AOL Inc.                          AIM:  gffletch
Mobile: +1-703-462-3494           Twitter: http://twitter.com/gffletch
Office: +1-703-265-2544           Photos: http://georgefletcher.photography

---

From: Phil Hunt <[email-masked]>
Date: Mon, 25 Jan 2016 10:41:46 -0800

+1.  I agree with Nat’s comment re the title.

Also, I would like to have a discussion in the WG around organization of the docs. What can we amend as errata (to give some of this stuff more prominence), and what new docs we should have?  With PKCE, mix-up, and this, we may end up causing more confusion or at the very least by having multiple “point” issue specs.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Jan 21, 2016, at 6:28 AM, Nat Sakimura <[email-masked]> wrote:
>

---

From: George Fletcher <[email-masked]>
Date: Mon, 25 Jan 2016 13:44:51 -0500

+1

On 1/25/16 1:41 PM, Phil Hunt wrote:
> Also, I would like to have a discussion in the WG around organization 
> of the docs. What can we amend as errata (to give some of this stuff 
> more prominence), and what new docs we should have?  With PKCE, 
> mix-up, and this, we may end up causing more confusion or at the very 
> least by having multiple “point” issue specs.
>
> Phil
>
> @independentid
> www.independentid.com <http://www.independentid.com>
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
>> On Jan 21, 2016, at 6:28 AM, Nat Sakimura <[email-masked] 
>>>     <[email-masked] <mailto:[email-masked]>>
>>>     wrote:
>>>
>>>         Hi all,
>>>