Subject: [Txauth] Raw notes from today's side meeting

From: Yaron Sheffer <[email-masked]>
Date: Thu, 21 Nov 2019 11:48:51 +0800

Thank you Dick and Justin for arranging the meeting. Please respond if I misquoted you or omitted something big.

Agenda
What do we do now
Extend, create a new one, both 
Dig into proposal
Charter - existing OAuth charter very specific, maybe roll back? Leif: this is easy

Justin: good reasons to have it a small, well scoped WG

Torsten: TLS/IPsec did not spin up a new WG

Leif: a design team would be seen as going around the WG

Annabelle: doing it in the WG would drag it back into the OAuth cruft, litigation re: transition story, could easily fall back into a 2.1.

Torsten: for sure will not be backward compatible.

Justin: OIDC is another example of a separate group. Brian: did not start that way.

Leif: design teams sometimes get push back (perception of WG impersonating as a design team)

Dick: important to have a focused mailing list

Justin: new use cases, not the same implementors

Annabelle: but still same community

Yann: current proposal doesn't look like a "version", similar to the difference with SAML.

Justin: maybe it's not even OAuth.

Dick: eventually new deployments will use the new protocol.

Annabelle: is there a major scope change?

Justin: Roman would like to see scope, charter

Justin will craft a charter proposal with Roman, will post to the list. Charter can be a WG charter or a paragraph in the OAuth WG charter

DID: will probably fall into a separate doc. Handles: some of them may need to be renamed. "Alias"?

Return code hashes: adds security to the client, to deal with session fixation, phishing issues. 

Could use HTTP2 sessions instead of polling - but is it a second way to do the same thing. HTTP2 is still not viable as a mandatory way. Does HTTP2 know how to cover from a RCP reset?

Torsten: by the time we're there we will have HTTP2. Similar to a discussion we had in the past on whether OAuth would require TLS. 

Leif: are we duplicating transport level security mechanisms (vs. HTTP2+TLS)?

Decouple from transport? Justin: no. Specificity to transport needs to be part of the charter.

Possibly targeting "UMA 3".

Set up virtual interims before Vancouver.

Torsten: need a scope, use cases, and architecture.