Subject: [OAUTH-WG] Follow up on draft-ietf-oauth-device-flow-08

From: Eric Rescorla <[email-masked]>
Date: Fri, 13 Apr 2018 17:59:47 -0700

Hi folks,

I just looked at the -08 diffs and I see a new section on brute forcing the
token
but not describing the confused deputy attack. Did I miss something, or
were you
still planning to add more text?

Thanks
-Ekr

---

From: Mike Jones <[email-masked]>
Date: Sat, 14 Apr 2018 01:06:54 +0000

We still need to add the text addressing the points described in John Bradley’s reply to you sent while in London.

                                                       -- Mike

From: OAuth <[email-masked]> On Behalf Of Eric Rescorla
Sent: Friday, April 13, 2018 6:00 PM
To: [email-masked]
Subject: [OAUTH-WG] Follow up on draft-ietf-oauth-device-flow-08

Hi folks,

I just looked at the -08 diffs and I see a new section on brute forcing the token
but not describing the confused deputy attack. Did I miss something, or were you
still planning to add more text?

Thanks
-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 13 Apr 2018 19:37:24 -0700

Thanks for the quick followup. I will take a look at the next version

-Ekr

On Fri, Apr 13, 2018 at 6:06 PM, Mike Jones <[email-masked]>
wrote:

> We still need to add the text addressing the points described in John
> Bradley’s reply to you sent while in London.
>
>
>
>                                                        -- Mike
>
>
>
> *From:* OAuth <[email-masked]> *On Behalf Of * Eric Rescorla
> *Sent:* Friday, April 13, 2018 6:00 PM
> *To:* [email-masked]
> *Subject:* [OAUTH-WG] Follow up on draft-ietf-oauth-device-flow-08
>
>
>
> Hi folks,
>
>
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 23 Apr 2018 19:20:09 +0000

https://tools.ietf.org/html/draft-ietf-oauth-device-flow-09  Sections 5.2 and 5.3 contain the confused deputy attack updates described in John’s response during London.

                                                                -- Mike

From: Eric Rescorla <[email-masked]>
Sent: Friday, April 13, 2018 7:37 PM
To: Mike Jones <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Follow up on draft-ietf-oauth-device-flow-08

-Ekr

On Fri, Apr 13, 2018 at 6:06 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
We still need to add the text addressing the points described in John Bradley’s reply to you sent while in London.

                                                       -- Mike

From: OAuth <[email-masked]<mailto:[email-masked]>> On Behalf Of Eric Rescorla
Sent: Friday, April 13, 2018 6:00 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [OAUTH-WG] Follow up on draft-ietf-oauth-device-flow-08

Hi folks,

Thanks
-Ekr