Subject: [OAUTH-WG] Alissa Cooper's No Objection on draft-ietf-oauth-device-flow-11: (with COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Tue, 31 Jul 2018 08:58:10 -0700

Alissa Cooper has entered the following ballot position for
draft-ietf-oauth-device-flow-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I support Mirja's DISCUSS point #3 which was also raised by the Gen-ART
reviewer. The Gen-ART review also included a number of other useful comments.
Please address them.

Perhaps this is implicit, but I found it a little odd that there is no mention
of whether the device codes and user codes are expected to be unique to
individual devices.

Section 3.3:

"It is NOT RECOMMENDED for authorization servers to include the user
   code in the verification URI ("verification_uri"), as this increases
   the length and complexity of the URI that the user must type."

I don't fully understand the justification for the normative requirement here.
The user ultimately ends up typing in both strings, right? Is it so much more
complex to type them both into a browser bar contiguously than to type the uri
into the browser bar and the code into some form field on the page such that
the normative requirement is warranted?

Section 3.3.1:

Wouldn't there be textual instructions about how to use the QR code also
included here? If the point is to illustrate the UI it seems like those should
be included too.