Subject: Re: [OAUTH-WG] Publication has been requested for draft-ietf-oauth-device-flow-07

From: William Denniss <[email-masked]>
Date: Tue, 06 Mar 2018 06:23:47 +0000

Thanks again for the feedback Scott. I've staged an update here:
https://github.com/WilliamDenniss/draft-ietf-oauth-device-flow/pull/6

It expands on the brute force attack section to include some detail on this
attack, as it is quite unique for OAuth brute-force attacks (since the
victim actually ends up with the attacker's grant on the device, instead of
the other way around – not that this is totally safe of course, it's just
unique).  It also adds some further discussion around what factors need to
be considered by authorization servers when creating the user code format.

I'll post this once my co-authors have reviewed, and the submission tool
re-opens.

On Fri, Jan 5, 2018 at 10:56 AM Rifaat Shekh-Yusef <[email-masked]>
wrote:

> Hi Scott,
>
> Sorry, I missed that last discussion that you had with William.
>
>
> *William,*
>
> Can you please update the document based on your last discussion with
> Scott?
> I will then update the request for publication to use the new updated
> version.
>
> Regards,
>  Rifaat
>
>
>
> On Fri, Jan 5, 2018 at 12:40 PM, Hollenbeck, Scott <
> [email-masked]> wrote:
>
>> > -----Original Message-----
>> > From: OAuth [mailto:[email-masked]] On Behalf Of Rifaat Shekh-
>> > Yusef
>> > Sent: Friday, January 05, 2018 12:30 PM
>> > To: [email-masked]
>> > Cc: [email-masked]; [email-masked]; [email-masked]
>> > Subject: [EXTERNAL] [OAUTH-WG] Publication has been requested for draft-
>> > ietf-oauth-device-flow-07
>> >
>> > Rifaat Shekh-Yusef has requested publication of draft-ietf-oauth-device-
>> > flow-07 as Proposed Standard on behalf of the OAUTH working group.
>> >
>> > Please verify the document's state at
>> > https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/
>>
>> The document really should be updated to reflect the last call
>> discussions prior to requesting publication for the -07 version that needs
>> to be updated.
>>
>> Scott
>>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Justin Richer <[email-masked]>
Date: Thu, 8 Mar 2018 10:19:45 -0800

+1

> On Mar 5, 2018, at 10:23 PM, William Denniss <[email-masked]> wrote:
> 
> Thanks again for the feedback Scott. I've staged an update here: https://github.com/WilliamDenniss/draft-ietf-oauth-device-flow/pull/6 <https://github.com/WilliamDenniss/draft-ietf-oauth-device-flow/pull/6>
> 
> It expands on the brute force attack section to include some detail on this attack, as it is quite unique for OAuth brute-force attacks (since the victim actually ends up with the attacker's grant on the device, instead of the other way around – not that this is totally safe of course, it's just unique).  It also adds some further discussion around what factors need to be considered by authorization servers when creating the user code format.
> 
> I'll post this once my co-authors have reviewed, and the submission tool re-opens.
> 
> 
> On Fri, Jan 5, 2018 at 10:56 AM Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]>> wrote:
> Hi Scott,
> 
> William,
> Can you please update the document based on your last discussion with Scott?
> I will then update the request for publication to use the new updated version.
> 
> Regards,
>  Rifaat
> 
> 
> 
> On Fri, Jan 5, 2018 at 12:40 PM, Hollenbeck, Scott <[email-masked] <mailto:[email-masked]>> wrote:
> > From: OAuth [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Rifaat Shekh-
> > Yusef
> > To: [email-masked] <mailto:[email-masked]>
> > Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> > https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/ <https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/>
> 
> The document really should be updated to reflect the last call discussions prior to requesting publication for the -07 version that needs to be updated.
> 
> Scott
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: William Denniss <[email-masked]>
Date: Mon, 19 Mar 2018 12:06:04 +0000

The update has been posted and is now available.
https://tools.ietf.org/html/draft-ietf-oauth-device-flow-08

Thanks Scott for the feedback, and Justin for reviewing!

On Thu, Mar 8, 2018 at 6:19 PM Justin Richer <[email-masked]> wrote:

> It expands on the brute force attack section to include some detail on
> this attack, as it is quite unique for OAuth brute-force attacks (since the

---

From: Justin Richer <[email-masked]>
Date: Mon, 19 Mar 2018 15:19:04 +0000

Something to consider in the new security text that’s just occurred to me: 

If an attacker gets their account tied to a user’s device, there’s a risk that the attacker would potentially be able to get that user’s information as input through the device. Setting aside the obvious alexa-style panopticon boxes for a minute, just think of a set-top box that allows you to enter your credit card information through the device itself. You’d then be buying your attacker the new season of Stargate, or whatever.

 — Justin

> On Mar 19, 2018, at 12:06 PM, William Denniss <[email-masked]> wrote:
> 
> The update has been posted and is now available. https://tools.ietf.org/html/draft-ietf-oauth-device-flow-08 <https://tools.ietf.org/html/draft-ietf-oauth-device-flow-08>
> 
> On Thu, Mar 8, 2018 at 6:19 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
> +1
> 
>> On Mar 5, 2018, at 10:23 PM, William Denniss <[email-masked] <mailto:[email-masked]>> wrote:
>>