Subject: [OAUTH-WG] Is OAUTH actually open

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 28 Sep 2009 09:28:23 -0400

I have been using a number of OAUTH enabled Web Sites, mostly through
use of my Twitter account.

What worries me a lot, and what currently disqualifies OAUTH
deployments as 'open' is the fact that I can only use the one or two
providers that are supported by the relying party site. This would be
OK if it was a choice on the part of the relying party site, but as
currently specified the scheme does not allow for open selection of
identity providers. Only the small number of providers supported by
the site will work.

I suggest adding one extra dimension to the OAUTH user experience, a
box that allows the user to specify their account and provider in
RFC822 form - i.e. I would type [email-masked] to use my twitter
account.

OK so this might not be OAUTH at issue here, but if OAUTH is going to
be a security protocol that is designed to interface with users it had
better encompass the entire user interface.

Yes, I know that this is not the way OpenID do it. They have this
strange notion that it is easier to teach every one of the billion
Internet users to type in funky URLs than to use the account
identifier that they are familiar with.

I find the idea that Joe Random User is going to want to log into
their fuzzypegs account using their blog ID quite bizarre. At best
that would be an edge case. The list of blogs (I have twenty) that the
user maintains is at best metadata that might be retrieved along with
other identity attributes.

And yes, I know that XRI is purportedly there to solve a problem that
the IETF has solved just great thirty years ago, and build out a
registry for our convenience and their profit. I see zero advantage to
XRI. We have a name infrastructure for the Internet, we do not need a
second.

While I have no particular issue with the way twitter is run today, I
want to own and control my own Internet name. The only infrastructure
on offer today that allows that is the DNS. Consequently I own
hallambaker.com.

Playing spymaster with my twitter account is OK, but it puts my
ability to play the game at the whim of twitter, a company that has no
business model. Clearly they will find a business model at some point,
and it might not be one I agree with.

All we need to do in the OAUTH specs is to state how to deal with
'everything else'.

One big advantage of using the RFC822 address is that many site
already use it as a username. They understand that most people who
come to their site have forgotten their account name which inevitably
varies from site to site. The password on the other hand, is always
the same. So people forget account names more often than passwords.

Such a site could easily convert to using OAUTH authentication with
RFC822 ids. Say I am logging into the dalek enthusiasts site and have
forgotten my account info. I give my email address, but instead of
doing the usual email callback loop, the site checks to see if
gmail.com supports OAUTH and if so lets me use OAUTH for the login and
deletes its local password checks altogether.

---

From: Dan Brickley <[email-masked]>
Date: Mon, 28 Sep 2009 15:35:46 +0200

> Hi Phillip,

Re user@domain instead of http:// I suspect you are pushing at an open  
door. Many in the openid scene seem to have arrived at the same  
conclusion - search for 'webfinger' for details of a proposal for an  
email-style account identifier notation, discovery/lookup protocol and  
draft uri scheme.

Cheers,

[email-masked]

---

From: Chris Messina <[email-masked]>
Date: Mon, 28 Sep 2009 17:20:12 +0300

Indeed, the problem is less with OAuth or forcing the use of email-style
identifiers for discovery (again, Webfinger is the right thing to point to
at this stage, though we already attempted to solve this once before with
the less-well-named EAUT ("email-addres to URL translation")) than the
problem that OAuth only deals with signatures and tokens — not with the
design of the API itself.
That is, even if you could identify yourself by an email address to some
third party advertising using only your email address, and they provided
OAuth as the means to do an in-browser request for a token to interact with
your account — the third party and your data provider still have to speak
the same input-output language. Now, perhaps that's using the Twitter API,
but what if it isn't? You may have granted the third party a token to access
your data, but they have no idea how to speak to your particular data
provider.

Therefore you have to go much deeper than how you discover your data
provider and what form your identifier is in. Presuming we get widespread
adoption of an agreed-upon identifier format (which is increasingly looks
like URLs and email-style identifiers), you still have to deal with getting
parties to use the same API nomenclature.

That, it would seem, is the much harder, longer term problem.

Chris

On Mon, Sep 28, 2009 at 4:35 PM, Dan Brickley <[email-masked]> wrote:

> door. Many in the openid scene seem to have arrived at the same conclusion -
> search for 'webfinger' for details of a proposal for an email-style account
> identifier notation, discovery/lookup protocol and draft uri scheme.
>
> Cheers,
>
> [email-masked]
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is:   [ ] shareable    [X] ask first   [ ] private

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 28 Sep 2009 08:51:28 -0700

This is completely out of scope. OAuth is closer to HTTP Basic than to  
OpenID.  Either way, how the user authenticate is out of scope.

EHL

---

From: John Panzer <[email-masked]>
Date: Mon, 28 Sep 2009 11:36:15 -0700

This is out of scope for OAuth.  As a redirect, please see this extension:
http://step2.googlecode.com/svn/spec/openid_oauth_extension/latest/openid_oauth_extension.html

Query:  Where should discussion of such extensions live?  Especially ones
that are, um, hybrids across two WGs :)

--
John Panzer / Google
[email-masked] / abstractioneer.org <http://www.abstractioneer.org/> /
@jpanzer

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 28 Sep 2009 11:58:17 -0700

I would suggest the OpenID foundation since between OpenID and OAuth, OpenID is the more limiting technology (OpenID providers are more likely to adopt OAuth than OAuth providers to adopt OpenID).

EHL

From: John Panzer [mailto:[email-masked]]
Sent: Monday, September 28, 2009 11:36 AM
To: Eran Hammer-Lahav
Cc: Phillip Hallam-Baker; [email-masked]
Subject: Re: [OAUTH-WG] Is OAUTH actually open

Query:  Where should discussion of such extensions live?  Especially ones that are, um, hybrids across two WGs :)

--
John Panzer / Google
[email-masked]<mailto:[email-masked]> / abstractioneer.org<http://www.abstractioneer.org/> / @jpanzer

On Mon, Sep 28, 2009 at 8:51 AM, Eran Hammer-Lahav <[email-masked]<mailto:[email-masked]>> wrote:
This is completely out of scope. OAuth is closer to HTTP Basic than to
OpenID.  Either way, how the user authenticate is out of scope.

EHL

On Sep 28, 2009, at 6:28, "Phillip Hallam-Baker" <[email-masked]<mailto:[email-masked]>>
wrote:

> RFC822 form - i.e. I would type [email-masked]<mailto:[email-masked]> to use my twitter
> account.
>
>
> hallambaker.com<http://hallambaker.com>.
>
> gmail.com<http://gmail.com> supports OAUTH and if so lets me use OAUTH for the login and
> [email-masked]<mailto:[email-masked]>
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth