Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-lodderstedt-oauth-rar-02.txt

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 6 Oct 2019 14:11:32 +0200

> 
> This is absolutely something that needs to be mentioned in the
> security & privacy considerations.
> 
> My worry is that by leading with an example of account numbers in the
> request URL, we're sending the wrong message.
> 
> I do see the value in rich authorization requests with no PII like
> George described, so I would be happy if:
> 
> * the example in this draft of the GET request was an example with no PII
> * there was an additional example using PAR that includes the full
> bank account transfer in the current draft

Hi Aaron, 

I fully agree with you. The examples need to be reworked. 

Please note: the privacy considerations section (https://tools.ietf.org/html/draft-lodderstedt-oauth-rar-02#section-6) already contains text regarding protection of PII. Does this address your concerns?

best regards,
Torsten. 

PS: sorry for not swiftly reacting on your posts, my e-mail provider’s spam filter has swallowed the whole thread :-(