Subject: Re: [OAUTH-WG] Question regarding OAuth SPOP

From: Nat Sakimura <[email-masked]>
Date: Tue, 2 Sep 2014 00:13:53 +0900

Hi.

Sorry for a slow reply. Please find my answers inline:

2014-08-28 20:16 GMT+09:00 Hannes Tschofenig <[email-masked]>:

> Hi Nat, Hi John,
>
> I have been trying to do a detailed review of the OAuth SPOP document
> http://datatracker.ietf.org/doc/draft-ietf-oauth-spop/
> and I ran into a few questions regarding the capabilities of the attacker.
>
> Is it correct that you assume that the attacker is only able to
> intercept the Authorization Response message but not the Authorization
> Request message?
>

Yes.
On iOS devices, it seems to be the case that it is always Safari that is
invoked via https request message, unless your are using a jail broken
device, in which case, you are on your own. Another risk factor is that if
the app provides "Open with Chrome" like capability. In this case, an
attacker may create an app with the same custom scheme as Chrome, but the
app can obviously avoid it by not providing the option.

On Android devices, apps can be invoked through explicit intent. It amounts
to specifying package name and class name so if attacker succeeds in having
the user install malicious "chrome" etc., then the attack would succeed,
but that involves deceiving the user to have him install "malicious chrome"
at which point, the devices is so screwed and I would like to consider it
out of scope.

> The security consideration section of the document is a bit fuzzy about
> this issue and says:
> "
> the client MUST make sure that the request channel is adequately protected
> "
>
> It is, however, not clear what request channel you are talking about and
> what you mean by adequately protected.
>

The security consideration can be expanded to include the above. The reason
I stopped at what is written now is that the above statement may become
obsolete in the future, which is possibly be quite soon.

Cheers,

Nat

>
> Ciao
> Hannes
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en