Subject: [OAUTH-WG] OAuth 2 for Native Apps

From: Marius Scurtescu <[email-masked]>
Date: Mon, 7 Jun 2010 12:25:53 -0700

Hi,

I attached a document that summaries how native applications can use OAuth 2.

Feedback more than welcome, especially if you have experience with
native apps and OAuth.

The current Web Server and Device flows need small changes and
clarifications in order to properly support native apps, I will start
a separate thread on that.

Marius

---

From: David Recordon <[email-masked]>
Date: Wed, 9 Jun 2010 10:59:09 -0700

Want to put this on the wiki http://wiki.oauth.net/?

On Mon, Jun 7, 2010 at 12:25 PM, Marius Scurtescu <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Marius Scurtescu <[email-masked]>
Date: Wed, 9 Jun 2010 11:02:35 -0700

Sure, will do that.

Marius

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 15 Jun 2010 00:19:10 -0700

Please turn this into a text proposal for section 1.4.3 in -08.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Marius Scurtescu
> Sent: Monday, June 07, 2010 12:26 PM
> To: OAuth WG
> Subject: [OAUTH-WG] OAuth 2 for Native Apps
> 
> Hi,
> 
> Feedback more than welcome, especially if you have experience with native
> apps and OAuth.
> 
> clarifications in order to properly support native apps, I will start a separate
> thread on that.
> 
> Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Mon, 21 Jun 2010 17:54:05 -0700

Here is the wiki page: http://wiki.oauth.net/OAuth-2-for-Native-Apps

Feel free to edit or comment.

Marius

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 26 Jun 2010 07:33:06 +0200

comment/question regarding the Embedded Browser scenario: Is the URL bar 
and SSL verification symbols (lock + green bar) visible in that 
scenario? Otherwise, the user has no chance to verify the identity of 
the IDP/OAuth server. So there might be problems regarding password 
phishing .

regards,
Torsten.

Am 22.06.2010 02:54, schrieb Marius Scurtescu:
> On Wed, Jun 9, 2010 at 10:59 AM, David Recordon<[email-masked]>  wrote:
>    
>> On Mon, Jun 7, 2010 at 12:25 PM, Marius Scurtescu<[email-masked]>  wrote:
>>      
>>> Hi,
>>>

---

From: Marius Scurtescu <[email-masked]>
Date: Mon, 28 Jun 2010 11:11:24 -0700

On Fri, Jun 25, 2010 at 10:33 PM, Torsten Lodderstedt
<[email-masked]> wrote:
> comment/question regarding the Embedded Browser scenario: Is the URL bar and
> SSL verification symbols (lock + green bar) visible in that scenario?
> Otherwise, the user has no chance to verify the identity of the IDP/OAuth
> server. So there might be problems regarding password phishing .

AFAIK the URL bar is not visible.

Who would phish the end user? If it is the native app, then all bets
are off regardless, the native app can show a fake address bar if it
really wants.

Marius