Subject: [OAUTH-WG] Updated Shepherd Write-Up for Native Apps document

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 6 Mar 2017 17:00:01 +0100

Here is the shepherd write-up:
https://github.com/hannestschofenig/tschofenig-ids/blob/master/shepherd-writeups/Writeup_OAuth_NativeApps.txt

Feedback appreciated. I will also do another shepherd review.

Ciao
Hannes

---

From: John Bradley <[email-masked]>
Date: Mon, 6 Mar 2017 17:32:29 -0300

You may want to note that RFC6749 itself recommends agains embedded for security reasons:
An embedded user-agent poses a security challenge because resource
      owners are authenticating in an unidentified window without access
      to the visual protections found in most external user-agents.  An
      embedded user-agent educates end-users to trust unidentified
      requests for authentication (making phishing attacks easier to
      execute).

However 6749 did not explicitly mention that for 3rd party OAuth Apps using an embedded user Agent  the 3rd party gets access to the password defeating one of the main goals of OAuth in keeping the password/credential out of the hands of the client.  This document makes that clearer.

John B.

> On Mar 6, 2017, at 1:00 PM, Hannes Tschofenig <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 7 Mar 2017 08:17:47 +0000

I'm still getting feedback on the Windows examples that are pointed to by the spec, since it's not a simple case on Windows 

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Monday, March 6, 2017 8:00 AM
To: [email-masked]
Subject: [OAUTH-WG] Updated Shepherd Write-Up for Native Apps document

Here is the shepherd write-up:
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fhannestschofenig%2Ftschofenig-ids%2Fblob%2Fmaster%2Fshepherd-writeups%2FWriteup_OAuth_NativeApps.txt&data=02%7C01%7Ctonynad%40microsoft.com%7C9a9ec9f090c74e34fb1a08d464a9e0a0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636244128165469063&sdata=olsSc81lMAqvlfAEBPCXY9CkIGv88W2Pt%2BkGj8yT2aY%3D&reserved=0

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 7 Mar 2017 09:23:23 +0100

Hi Tony

thanks for the feedback. I have requested publication of the document a
few minutes ago already and we will incorporate any remarks from my
co-workers as part of the IETF-wide last call.

Ciao
Hannes

---

From: William Denniss <[email-masked]>
Date: Tue, 07 Mar 2017 17:48:20 +0000

If you dislike the GitHub examples I referenced, I'm willing to remove the
reference.

FYI, I reworked the Windows implementation details section in the Appendix
after Buenos Aires, following technical discussions with Vittorio. Now it
includes the Authentication Broker pattern.

On Tue, Mar 7, 2017 at 12:23 AM Hannes Tschofenig <[email-masked]>
wrote:

Hi Tony

Ciao
Hannes

On 03/07/2017 09:17 AM, Anthony Nadalin wrote:
> I'm still getting feedback on the Windows examples that are pointed to by
the spec, since it's not a simple case on Windows