Subject: Re: [Txauth] WG name: TxAuth? XAuth? Something else?

From: Mike Jones <[email-masked]>
Date: Mon, 23 Mar 2020 19:38:56 +0000

In brainstorming mode…

  *   Disaggregated Authorization (DisAuth)
  *   Componentized Authorization (CompAuth)
  *   Build-Your-Own Authorization (BYOAuth)
  *   Do-It-Yourself Authorization (DIYAuth)
  *   Refactored Authorization (ReAuth or RefAuth)

And for fun…

  *   Dismembered Authorization

                                                       -- Mike

From: Txauth <[email-masked]> On Behalf Of David Skaife
Sent: Saturday, March 21, 2020 11:22 AM
To: Justin Richer <[email-masked]>
Cc: Yaron Sheffer <[email-masked]>; [email-masked]; Dick Hardt <[email-masked]>
Subject: Re: [Txauth] WG name: TxAuth? XAuth? Something else?

I think we're saying the same thing with regards to the working group name - I was saying it isn't particularly important in comparison to the name of the protocol (which obviously is very important).

On Sat, Mar 21, 2020 at 6:18 PM Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
I disagree on the working group name being super important. Nobody knows that the OAuth WG is actually named “The Web Authorization Protocol Working Group”, and nobody cares.

My proposal is that we name the protocol we work on “TxAuth” (and keep the mailing list), and that we name the working group something like “Next Generation Web Authorization Protocol” to say what we’re doing.

 -- Justin

On Mar 21, 2020, at 2:08 PM, David Skaife <[email-masked]<mailto:[email-masked]>> wrote:

Just to throw in another suggestion, to address Yaron's point about some people mistakenly thinking that "Auth" stands for authentication rather than authorization, how about naming the working group AuthZ
Nice and simple, and it makes it clear what the group is focused on.

I think the name of the actual protocol that we produce is far, far more important that the name of the working group - and the name of that protocol doesn't need to correlate to the WG name. Also, we have much more time before we need to decide on the name of that protocol, even if the initial draft documents that we produce end up using a placeholder name.

On Sat, Mar 21, 2020 at 5:44 PM Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
As you can see in the email you replied to, that is not even close to what I said. I believe it is a transaction, and therefore, I do not agree that it’s not a transaction.

But if we take “Transactional” out of the WG title, I won’t be offended. If we just call it “TxAuth” without expansion, then that’s fine.

I do not like calling it “XAuth”. The term “TAuth" was floated during naming the list, but rejected because (among other reasons) it would likely be awkwardly pronounced as “towth” or something. TxAuth reads as “Tee - ex - oth” more naturally, which was the intent.

So how about we take a page from the OAuth working group and name it:

TxAuth - Next Generation Web Authorization Protocol Working Group

 — Justin

On Mar 21, 2020, at 1:15 PM, Dick Hardt <[email-masked]<mailto:[email-masked]>> wrote:

To clarify -- you agree it is not a transaction, and we will take the word transaction out of the WG title?

On Fri, Mar 20, 2020 at 5:53 PM Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
Dick, thanks for pulling the definitions up:

> a communicative action or activity involving two parties or things that reciprocally affect or influence each other

This is the kind of thing that I had in mind. The client and the AS are in a conversation over time that each one contributes to and each changes.

Also — we can just as easily decide that “TxAuth” doesn’t stand for “Transactional Auth” much the same way we decided that the “O” in “OAuth” doesn’t stand for “Open” anymore.

None of the arguments below in favor of XAuth have made me like that name better. If it’s just a “placeholder” name, then why come up with something new?

 — Justin

On Mar 20, 2020, at 3:32 PM, Dick Hardt <[email-masked]<mailto:[email-masked]>> wrote:

not a transaction - there are multiple transactions

backchannel innovation is combination of here is who I am, and here is what I want to do

childhood trauma therapy group

On Mon, Mar 16, 2020 at 6:56 PM Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
Yes, naming things is hard — but I still believe in the name TxAuth. We’re moving beyond OAuth, and taking the process of getting an authorization delegated to the client software as a multi-step, multi-party transaction is, I believe, the key insight that’s letting us move beyond OAuth’s limitations here. It’s not just about going to the AS first — we had that in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think it’s about the transaction at the core..

OAuth 2.0 had multi-step, multi-party. TxAuth extends that.

I think the big shift is going to the AS. This enables the request to be richer with JSON, instead of name/value pairs parameters in a URI. It allows the client and AS to negotiate, and to short circuit having to redirect the user to the AS. PAR does some of this, but it is constrained by having to do it in the OAuth 2.0 context.

My concern is that the protocol is MUCH MORE than a transaction. While the initial interaction between client, AS, user and RO is a transaction. The protocol also covers the client and RS interactions. The access token refreshes. Access token revocation. Access token introspection. As described in the charter, there is a whole lifecycle, that consists of multiple transactions.

From https://www.merriam-webster.com/dictionary/transaction:

Definition of transaction
1a: something transacted<https://www.merriam-webster.com/dictionary/transacted>especially : an exchange or transfer<https://www.merriam-webster.com/dictionary/transfer> of goods, services, or fundselectronic transactions
b: transactions plural : the often published record of the meeting of a society or association
2a: an act, process, or instance of transacting<https://www.merriam-webster.com/dictionary/transacting>
b: a communicative action or activity involving two parties or things that reciprocally affect or influence each other

Calling the protocol a transaction will confusing to people.

Having come of age in the 1990’s, I have particular dislike for XAuth. It sounds too “X-TREME” and “X-CITING”, and if you read either of those with a growling yell in your head then you know exactly what I’m talking about.

In case you are confused, this is not a childhood trauma support group.  :)

Unlike "X-TREME" or "X-CITING", XAuth is using the "X" as a placeholder. X-Men, Xbox, X-Factor, X-files.

https://www.businessinsider.com/the-indisputable-power-of-brand-x-2012-4

https://english.stackexchange.com/questions/358181/whats-the-purpose-of-using-letter-x-or-x-as-a-suffix-in-brand-names

And to Dick’s rationale for the name below, I absolutely do NOT see this work as “OAuth with all the extra features”. I think that does a disservice to the kind of change we have an opportunity to make here.

From the charter

"It will expand upon the uses cases currently supported by OAuth 2.0 and OpenID Connect (itself an extension of OAuth 2.0)"

Which sounds pretty similar to “OAuth with all the extra features”

While I think XAuth captures what we are doing, a placeholder name would be preferable to an incorrect descriptive name such as TxAuth.

For example, XYZ is a good placeholder name. Or XYZAuth. Let's not mislead people.

 — Justin

On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked]<mailto:[email-masked]>> wrote:

Hello everyone

I prompted a thread around the name of the protocol a while back:

https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/

As Justin stated "naming is hard"

Wearing my marketing hat I want to ensure that the name will be perceived properly in the broader community.

A recent example that comes to mind are the privacy related works on the browser storage API. Given that name, one would think that it is local storage. It is actually about browser cookies.

Justin discussed his reasons for TxAuth in the thread above (and I'm sure in other places)

I chose XAuth in my draft to reflect the eXtensibility goal that we have over OAuth -- and XAuth is OAuth but with an X to reflect all the extra features. =)

Other suggestions?

This will be an agenda item in the BoF -- but the name will NOT be an open discussion item -- we will summarize what has been discussed on the list and perhaps do a poll of options presented unless consensus is obvious from this thread.

/Dick

ᐧ

--
Txauth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/txauth

---

From: Brian Campbell <[email-masked]>
Date: Mon, 23 Mar 2020 13:49:55 -0600

YAAAAS - Yet Another Authorization And Authentication Specification

On Mon, Mar 23, 2020 at 1:39 PM Mike Jones <Michael.Jones=
[email-masked]> wrote:

> In brainstorming mode…
>
>    - Disaggregated Authorization (DisAuth)
>    - Componentized Authorization (CompAuth)
>    - Build-Your-Own Authorization (BYOAuth)
>    - Do-It-Yourself Authorization (DIYAuth)
>    - Refactored Authorization (ReAuth or RefAuth)
>
>
>
> And for fun…
>
>    - Dismembered Authorization
>
>
>
>                                                        -- Mike
>
>
>
> *From:* Txauth <[email-masked]> *On Behalf Of *David Skaife
> *Sent:* Saturday, March 21, 2020 11:22 AM
> *To:* Justin Richer <[email-masked]>
> *Cc:* Yaron Sheffer <[email-masked]>; [email-masked]; Dick Hardt <
> [email-masked]>
> *Subject:* Re: [Txauth] WG name: TxAuth? XAuth? Something else?
>
>
>
> I think we're saying the same thing with regards to the working group name
> - I was saying it *isn't* particularly important in comparison to the
> name of the protocol (which obviously is very important).
>
>
>
> On Sat, Mar 21, 2020 at 6:18 PM Justin Richer <[email-masked]> wrote:
>
> I disagree on the working group name being super important. Nobody knows
> that the OAuth WG is actually named “The Web Authorization Protocol Working
> Group”, and nobody cares.
>
>
>
> My proposal is that we name the protocol we work on “TxAuth” (and keep the
> mailing list), and that we name the working group something like “Next
> Generation Web Authorization Protocol” to say what we’re doing.
>
>
>
>  -- Justin
>
>
>
> On Mar 21, 2020, at 2:08 PM, David Skaife <
> [email-masked]> wrote:
>
>
>
> Just to throw in another suggestion, to address Yaron's point about some
> people mistakenly thinking that "Auth" stands for authentication rather
> than authorization, how about naming the working group *AuthZ*
>
> I think the name of the actual protocol that we produce is far, far more
> important that the name of the working group - and the name of that
> protocol doesn't need to correlate to the WG name. Also, we have much more
> time before we need to decide on the name of that protocol, even if the
> initial draft documents that we produce end up using a placeholder name.
>
>
>
> On Sat, Mar 21, 2020 at 5:44 PM Justin Richer <[email-masked]> wrote:
>
> As you can see in the email you replied to, that is not even close to what
> I said. I believe it is a transaction, and therefore, I do not agree that
> it’s not a transaction.
>
>
>
> But if we take “Transactional” out of the WG title, I won’t be offended.
> If we just call it “TxAuth” without expansion, then that’s fine.
>
>
>
> I do not like calling it “XAuth”. The term “TAuth" was floated during
> naming the list, but rejected because (among other reasons) it would likely
> be awkwardly pronounced as “towth” or something. TxAuth reads as “Tee - ex
> - oth” more naturally, which was the intent.
>
>
>
> On Mar 21, 2020, at 1:15 PM, Dick Hardt <[email-masked]> wrote:
>
>
>
> On Fri, Mar 20, 2020 at 5:53 PM Justin Richer <[email-masked]> wrote:
>
> > a communicative action or activity involving two parties or things that
> reciprocally affect or influence each other
>
>
>
> This is the kind of thing that I had in mind. The client and the AS are in
> a conversation over time that each one contributes to and each changes.
>
>
>
> Also — we can just as easily decide that “TxAuth” doesn’t stand for
> “Transactional Auth” much the same way we decided that the “O” in “OAuth”
> doesn’t stand for “Open” anymore.
>
>
>
> None of the arguments below in favor of XAuth have made me like that name
> better. If it’s just a “placeholder” name, then why come up with something
> new?
>
>
>
>  — Justin
>
>
>
> On Mar 20, 2020, at 3:32 PM, Dick Hardt <[email-masked]> wrote:
>
>
>
>
>
>
>
>
>
> On Mon, Mar 16, 2020 at 6:56 PM Justin Richer <[email-masked]> wrote:
>
> Yes, naming things is hard — but I still believe in the name TxAuth. We’re
> moving beyond OAuth, and taking the process of getting an authorization
> delegated to the client software as a multi-step, multi-party transaction
> is, I believe, the key insight that’s letting us move beyond OAuth’s
> limitations here. It’s not just about going to the AS first — we had that
> in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think
> it’s about the transaction at the core..
>
>
>
> I think the big shift is going to the AS. This enables the request to be
> richer with JSON, instead of name/value pairs parameters in a URI. It
> allows the client and AS to negotiate, and to short circuit having to
> redirect the user to the AS. PAR does some of this, but it is constrained
> by having to do it in the OAuth 2.0 context.
>
>
>
> My concern is that the protocol is MUCH MORE than a transaction. While the
> initial interaction between client, AS, user and RO is a transaction. The
> protocol also covers the client and RS interactions. The access token
> refreshes. Access token revocation. Access token introspection. As
> described in the charter, there is a whole lifecycle, that consists of
> multiple transactions.
>
>
>
> Definition of *transaction*
>
> *1a**: *something transacted
> <https://www.merriam-webster.com/dictionary/transacted>*especially* *: *an
> exchange or transfer <https://www.merriam-webster.com/dictionary/transfer> of
> goods, services, or fundselectronic *transactions*
>
> *b: transactions** plural* *: *the often published record of the meeting
> of a society or association
>
> *2a**: *an act, process, or instance of transacting
> <https://www.merriam-webster.com/dictionary/transacting>
>
> *b**: *a communicative action or activity involving two parties or things
> that reciprocally affect or influence each other
>
>
>
> Having come of age in the 1990’s, I have particular dislike for XAuth. It
> sounds too “X-TREME” and “X-CITING”, and if you read either of those with a
> growling yell in your head then you know exactly what I’m talking about.
>
>
>
> And to Dick’s rationale for the name below, I absolutely do NOT see this
> work as “OAuth with all the extra features”. I think that does a disservice
> to the kind of change we have an opportunity to make here.
>
>
>
> From the charter
>
>
>
> "It will expand upon the uses cases currently supported by OAuth 2.0 and
> OpenID Connect (itself an extension of OAuth 2.0)"
>
>
>
> While I think XAuth captures what we are doing, a placeholder name would
> be preferable to an incorrect descriptive name such as TxAuth.
>
>
>
> On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked]> wrote:
>
>
>
> Hello everyone
>
>
>
> Wearing my marketing hat I want to ensure that the name will be
> perceived properly in the broader community.
>
>
>
> A recent example that comes to mind are the privacy related works on the
> browser storage API. Given that name, one would think that it is local
> storage. It is actually about browser cookies.
>
>
>
> I chose XAuth in my draft to reflect the eXtensibility goal that we have
> over OAuth -- and XAuth is OAuth but with an X to reflect all the extra
> features. =)
>
>
>
> Other suggestions?
>
>
>
> This will be an agenda item in the BoF -- but the name will NOT be an open
> discussion item -- we will summarize what has been discussed on the list
> and perhaps do a poll of options presented unless consensus is obvious from
> this thread.
>
>
>
> /Dick
>
>
>
>
>
>
>
>
>
>
>
> ᐧ
>
>
>
>
>
>
>
> --
> Txauth mailing list
> [email-masked]
> [email-masked]

-- 
<https://www.pingidentity.com>
<https://www.pingidentity.com>
Brian Campbell
Distinguished Engineer
[email-masked]
w: +1 720.317.2061
c: +1 303.918.9415
Connect with us: 
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
logo] <https://twitter.com/pingidentity> 
<https://www.facebook.com/pingidentitypage> 
<https://www.youtube.com/user/PingIdentityTV> 
<https://www.pingidentity.com/en/blog.html>
<https://www.google.com/url?q=https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/faqs/en/consumer-attitudes-post-breach-era-3375.pdf?id%3Db6322a80-f285-11e3-ac10-0800200c9a66&source=gmail&ust=1541693608526000&usg=AFQjCNGBl5cPHCUAVKGZ_NnpuFj5PHGSUQ>
<https://www.pingidentity.com/en/events/d/identify-2019.html>
<https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf>
<https://www.pingidentity.com/en/events/e/rsa.html>
<https://www.pingidentity.com/en/events/e/rsa.html>
<https://www.pingidentity.com/en/lp/e/enabling-work-from-home-with-MFA.html>
*If you’re not a current customer, click here
<https://www.pingidentity.com/en/lp/e/work-from-home-sso-mfa.html?utm_source=Email&utm_campaign=WF-COVID19-New-EMSIG>
for
a more relevant offer.*

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Leif Johansson <[email-masked]>
Date: Mon, 23 Mar 2020 22:59:18 +0100

> YAAAAS - Yet Another Authorization And Authentication Specification

Son of OAuth - soauth

---

From: "Matthew A. Miller" <[email-masked]>
Date: Mon, 23 Mar 2020 16:05:37 -0600

> YAAAAS - Yet Another Authorization And Authentication Specification

+1

- m&m

Matthew A. Miller

> On Mon, Mar 23, 2020 at 1:39 PM Mike Jones
> <Michael.Jones=40microsoft.com@dmarc..ietf.org
> <mailto:[email-masked]>> wrote:
> 
>     In brainstorming mode…____
> 
>       * Disaggregated Authorization (DisAuth)____
>       * Componentized Authorization (CompAuth)____
>       * Build-Your-Own Authorization (BYOAuth)____
>       * Do-It-Yourself Authorization (DIYAuth)____
>       * Refactored Authorization (ReAuth or RefAuth)____
> 
>     __ __
> 
>     And for fun…____
> 
>       * Dismembered Authorization____
> 
>     __ __
> 
>                                                            -- Mike____
> 
>     __ __
> 
>     *From:* Txauth <[email-masked]
>     <mailto:[email-masked]>> *On Behalf Of *David Skaife
>     *To:* Justin Richer <[email-masked] <mailto:[email-masked]>>
>     *Cc:* Yaron Sheffer <[email-masked]
>     <mailto:[email-masked]>>; [email-masked]
>     <mailto:[email-masked]>; Dick Hardt <[email-masked]
>     <mailto:[email-masked]>>
>     *Subject:* Re: [Txauth] WG name: TxAuth? XAuth? Something else?____
> 
>     __ __
> 
>     I think we're saying the same thing with regards to the working
>     group name - I was saying it *isn't* particularly important in
>     comparison to the name of the protocol (which obviously is very
>     important).____
> 
>     __ __
> 
>     On Sat, Mar 21, 2020 at 6:18 PM Justin Richer <[email-masked]
>     <mailto:[email-masked]>> wrote:____
> 
>         I disagree on the working group name being super important.
>         Nobody knows that the OAuth WG is actually named “The Web
>         Authorization Protocol Working Group”, and nobody cares.____
> 
>         __ __
> 
>         My proposal is that we name the protocol we work on “TxAuth”
>         (and keep the mailing list), and that we name the working group
>         something like “Next Generation Web Authorization Protocol” to
>         say what we’re doing.____
> 
>         __ __
> 
>          -- Justin____
> 
> 
> 
>         ____
> 
>             On Mar 21, 2020, at 2:08 PM, David Skaife
>             <[email-masked]
>             <mailto:[email-masked]>> wrote:____
> 
>             __ __
> 
>             Just to throw in another suggestion, to address Yaron's
>             point about some people mistakenly thinking that "Auth"
>             stands for authentication rather than authorization, how
>             about naming the working group *AuthZ*____
> 
>             I think the name of the actual protocol that we produce is
>             far, far more important that the name of the working group -
>             and the name of that protocol doesn't need to correlate to
>             the WG name. Also, we have much more time before we need to
>             decide on the name of that protocol, even if the
>             initial draft documents that we produce end up using a
>             placeholder name.____
> 
>             __ __
> 
>             On Sat, Mar 21, 2020 at 5:44 PM Justin Richer
>             <[email-masked] <mailto:[email-masked]>> wrote:____
> 
>                 As you can see in the email you replied to, that is not
>                 even close to what I said. I believe it is a
>                 transaction, and therefore, I do not agree that it’s not
>                 a transaction.____
> 
>                 __ __
> 
>                 But if we take “Transactional” out of the WG title, I
>                 won’t be offended. If we just call it “TxAuth” without
>                 expansion, then that’s fine.____
> 
>                 __ __
> 
>                 I do not like calling it “XAuth”. The term “TAuth" was
>                 floated during naming the list, but rejected because
>                 (among other reasons) it would likely be awkwardly
>                 pronounced as “towth” or something. TxAuth reads as “Tee
>                 - ex - oth” more naturally, which was the intent. ____
> 
>                 __ __
> 
>                 So how about we take a page from the OAuth working group
>                 and name it:____
> 
>                 __ __
> 
>                 TxAuth - Next Generation Web Authorization Protocol
>                 Working Group____
> 
>                 __ __
> 
>                 __ __
> 
>                  — Justin____
> 
> 
> 
>                 ____
> 
>                     On Mar 21, 2020, at 1:15 PM, Dick Hardt
>                     <[email-masked] <mailto:[email-masked]>>
>                     wrote:____
> 
>                     __ __
> 
>                     To clarify -- you agree it is not a transaction, and
>                     we will take the word transaction out of the WG
>                     title?____
> 
>                     __ __
> 
>                     On Fri, Mar 20, 2020 at 5:53 PM Justin Richer
>                     <[email-masked] <mailto:[email-masked]>> wrote:____
> 
>                         Dick, thanks for pulling the definitions up:____
> 
>                         __ __
> 
>                         > a communicative action or activity involving
>                         two parties or things that reciprocally affect
>                         or influence each other____
> 
>                         __ __
> 
>                         This is the kind of thing that I had in mind.
>                         The client and the AS are in a conversation over
>                         time that each one contributes to and each
>                         changes. ____
> 
>                         __ __
> 
>                         Also — we can just as easily decide that
>                         “TxAuth” doesn’t stand for “Transactional Auth”
>                         much the same way we decided that the “O” in
>                         “OAuth” doesn’t stand for “Open” anymore. ____
> 
>                         __ __
> 
>                         None of the arguments below in favor of XAuth
>                         have made me like that name better. If it’s just
>                         a “placeholder” name, then why come up with
>                         something new?____
> 
>                         __ __
> 
>                          — Justin____
> 
> 
> 
>                         ____
> 
>                             On Mar 20, 2020, at 3:32 PM, Dick Hardt
>                             <[email-masked]
>                             <mailto:[email-masked]>> wrote:____
> 
>                             __ __
> 
>                             __ __
> 
>                             __ __
> 
>                             __ __
> 
>                             not a transaction - there are multiple
>                             transactions____
> 
>                             __ __
> 
>                             backchannel innovation is combination of
>                             here is who I am, and here is what I want to
>                             do____
> 
>                             __ __
> 
>                             __ __
> 
>                             childhood trauma therapy group____
> 
>                             __ __
> 
>                             __ __
> 
>                             __ __
> 
>                             On Mon, Mar 16, 2020 at 6:56 PM Justin
>                             Richer <[email-masked]
>                             <mailto:[email-masked]>> wrote:____
> 
>                                 Yes, naming things is hard — but I still
>                                 believe in the name TxAuth. We’re moving
>                                 beyond OAuth, and taking the process of
>                                 getting an authorization delegated to
>                                 the client software as a multi-step,
>                                 multi-party transaction is, I believe,
>                                 the key insight that’s letting us move
>                                 beyond OAuth’s limitations here. It’s
>                                 not just about going to the AS first —
>                                 we had that in OAuth 1 and we’re
>                                 patching that into OAuth 2 with PAR.. I
>                                 really think it’s about the transaction
>                                 at the core.. ____
> 
>                             __ __
> 
>                             OAuth 2.0 had multi-step, multi-party.
>                             TxAuth extends that.____
> 
>                             __ __
> 
>                             I think the big shift is going to the AS.
>                             This enables the request to be richer with
>                             JSON, instead of name/value pairs parameters
>                             in a URI. It allows the client and AS to
>                             negotiate, and to short circuit having to
>                             redirect the user to the AS. PAR does some
>                             of this, but it is constrained by having to
>                             do it in the OAuth 2.0 context.____
> 
>                             __ __
> 
>                             My concern is that the protocol is MUCH MORE
>                             than a transaction. While the initial
>                             interaction between client, AS, user and RO
>                             is a transaction. The protocol also covers
>                             the client and RS interactions. The access
>                             token refreshes. Access token revocation.
>                             Access token introspection. As described in
>                             the charter, there is a whole lifecycle,
>                             that consists of multiple transactions.____
> 
>                             __ __
> 
>                             From https://www.merriam-webster.com/dictionary/transaction:____
> 
>                             __ __
> 
> 
>                                 Definition of /transaction/____
> 
>                             <https://www.merriam-webster.com/dictionary/transacted>/especially/ *: *an
>                             exchange or transfer
>                             <https://www.merriam-webster.com/dictionary/transfer> of
>                             goods, services, or
>                             fundselectronic /transactions/____
> 
>                             *b: transactions*/ plural/ *: *the often
>                             published record of the meeting of a society
>                             or association____
> 
>                             <https://www.merriam-webster.com/dictionary/transacting>____
> 
>                             *b**: *a communicative action or activity
>                             involving two parties or things that
>                             reciprocally affect or influence each other____
> 
>                             __ __
> 
>                             Calling the protocol a transaction will
>                             confusing to people.____
> 
>                              ____
> 
>                                 __ __
> 
>                                 Having come of age in the 1990’s, I have
>                                 particular dislike for XAuth. It sounds
>                                 too “X-TREME” and “X-CITING”, and if you
>                                 read either of those with a growling
>                                 yell in your head then you know exactly
>                                 what I’m talking about.____
> 
>                             __ __
> 
>                             In case you are confused, this is not a
>                             childhood trauma support group.  :)____
> 
>                             __ __
> 
>                             Unlike "X-TREME" or "X-CITING", XAuth is
>                             using the "X" as a placeholder. X-Men, Xbox,
>                             X-Factor, X-files. ____
> 
>                             __ __
> 
>                             https://www.businessinsider.com/the-indisputable-power-of-brand-x-2012-4____
> 
>                             __ __
> 
>                             https://english.stackexchange.com/questions/358181/whats-the-purpose-of-using-letter-x-or-x-as-a-suffix-in-brand-names____
> 
>                             __ __
> 
>                              ____
> 
>                                 And to Dick’s rationale for the name
>                                 below, I absolutely do NOT see this work
>                                 as “OAuth with all the extra features”.
>                                 I think that does a disservice to the
>                                 kind of change we have an opportunity to
>                                 make here. ____
> 
>                             __ __
> 
>                             From the charter ____
> 
>                             __ __
> 
>                                 OpenID Connect (itself an extension of
>                                 OAuth 2.0)"____
> 
>                             __ __
> 
>                             Which sounds pretty similar to “OAuth with
>                             all the extra features”____
> 
>                             __ __
> 
>                             While I think XAuth captures what we are
>                             doing, a placeholder name would be
>                             preferable to an incorrect descriptive name
>                             such as TxAuth.____
> 
>                             __ __
> 
>                             For example, XYZ is a good placeholder name.
>                             Or XYZAuth. Let's not mislead people.____
> 
>                              ____
> 
>                                 __ __
> 
>                                  — Justin____
> 
> 
> 
>                                 ____
> 
>                                     On Mar 16, 2020, at 7:04 PM, Dick
>                                     Hardt <[email-masked]
>                                     <mailto:[email-masked]>>
>                                     wrote:____
> 
>                                     __ __
> 
>                                     Hello everyone____
> 
>                                     __ __
> 
>                                     I prompted a thread around the name
>                                     of the protocol a while back:____
> 
>                                     __ __
> 
>                                     https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/____
> 
>                                     __ __
> 
>                                     As Justin stated "naming is hard"____
> 
>                                     __ __
> 
>                                     perceived properly in the broader
>                                     community.____
> 
>                                     __ __
> 
>                                     browser storage API. Given that
>                                     name, one would think that it is
>                                     local storage. It is actually about
>                                     browser cookies.____
> 
>                                     __ __
> 
>                                     Justin discussed his reasons for
>                                     TxAuth in the thread above (and I'm
>                                     sure in other places)____
> 
>                                     __ __
> 
>                                     features. =)____
>                                     __ __
>                                     Other suggestions?____
>                                     __ __
>                                     This will be an agenda item in the
>                                     BoF -- but the name will NOT be an
>                                     open discussion item -- we will
>                                     summarize what has been discussed on
>                                     the list and perhaps do a poll of
>                                     options presented unless consensus
>                                     is obvious from this thread.____
> 
>                                     __ __
> 
>                                     /Dick____
> 
>                                     __ __
> 
>                                     __ __
> 
>                                     __ __
> 
>                                     __ __
> 
>                                     __ __
> 
>                                     ᐧ____
> 
>                                 __ __
> 
>                         __ __
> 
>                 __ __
> 
>                 -- 
>                 Txauth mailing list
>                 [email-masked] <mailto:[email-masked]>
>                 https://www.ietf.org/mailman/listinfo/txauth____
> 
>         __ __
> 
>     -- 
>     Txauth mailing list
>     [email-masked] <mailto:[email-masked]>
> <https://www.pingidentity.com>Ping Identity <https://www.pingidentity.com>		
> Brian Campbell	
> Distinguished Engineer	
> [email-masked] <mailto:[email-masked]>	
> w: +1 720.317.2061	
> c: +1 303.918..9415	
> 
> Connect with us: 	Glassdoor logo
> LinkedIn logo <https://www.linkedin.com/company/21870> twitter logo
> <https://twitter.com/pingidentity>	facebook logo
> <https://www.facebook.com/pingidentitypage>	youtube logo
> <https://www.youtube.com/user/PingIdentityTV> Blog logo
> <https://www.google.com/url?q=https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/faqs/en/consumer-attitudes-post-breach-era-3375.pdf?id%3Db6322a80-f285-11e3-ac10-0800200c9a66&source=gmail&ust=1541693608526000&usg=AFQjCNGBl5cPHCUAVKGZ_NnpuFj5PHGSUQ><https://www.pingidentity.com/en/events/d/identify-2019.html><https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf><https://www.pingidentity.com/en/events/e/rsa.html><https://www.pingidentity.com/en/events/e/rsa.html><https://www.pingidentity.com/en/lp/e/enabling-work-from-home-with-MFA.html>
> 
> /If you’re not a current customer, click here
> <https://www.pingidentity.com/en/lp/e/work-from-home-sso-mfa.html?utm_source=Email&utm_campaign=WF-COVID19-New-EMSIG> for
> a more relevant offer./
> 
> /CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly
> prohibited..  If you have received this communication in error, please
> notify the sender immediately by e-mail and delete the message and any
> file attachments from your computer. Thank you./
>

---

From: Vittorio Bertocci <[email-masked]>
Date: Mon, 23 Mar 2020 15:11:14 -0700

+1 to YAAAS :)

On Mon, Mar 23, 2020 at 12:52 PM Brian Campbell <bcampbell=
[email-masked]> wrote:

> 40microsoft.com@dmarc..ietf.org <[email-masked]>> wrote:
>
>> In brainstorming mode…
>>
>> *Cc:* Yaron Sheffer <[email-masked]>; [email-masked]; Dick Hardt
>> <[email-masked]>
>> I think we're saying the same thing with regards to the working group
>> name - I was saying it *isn't* particularly important in comparison to
>> the name of the protocol (which obviously is very important).
>>
>>
>>
>> My proposal is that we name the protocol we work on “TxAuth” (and keep
>> the mailing list), and that we name the working group something like “Next
>> As you can see in the email you replied to, that is not even close to
>> what I said. I believe it is a transaction, and therefore, I do not agree
>> that it’s not a transaction.
>>
>>
>>
>> > a communicative action or activity involving two parties or things
>> This is the kind of thing that I had in mind. The client and the AS are
>> in a conversation over time that each one contributes to and each changes.
>>
>>
>>
>> Yes, naming things is hard — but I still believe in the name TxAuth.
>> We’re moving beyond OAuth, and taking the process of getting an
>> authorization delegated to the client software as a multi-step, multi-party
>> transaction is, I believe, the key insight that’s letting us move beyond
>> OAuth’s limitations here. It’s not just about going to the AS first — we
>> had that in OAuth 1 and we’re patching that into OAuth 2 with PAR.. I
>> really think it’s about the transaction at the core..
>>
>>
>>
>> My concern is that the protocol is MUCH MORE than a transaction. While
>> the initial interaction between client, AS, user and RO is a transaction.
>> The protocol also covers the client and RS interactions. The access token
>> <https://www.merriam-webster.com/dictionary/transfer> of goods,
>> services, or fundselectronic *transactions*
>>
>> *b**: *a communicative action or activity involving two parties or
>> things that reciprocally affect or influence each other
>>
>>
>>
>> This will be an agenda item in the BoF -- but the name will NOT be an
>> open discussion item -- we will summarize what has been discussed on the
>> list and perhaps do a poll of options presented unless consensus is obvious
>> from this thread.
>>
>>
>>
>> /Dick
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> ᐧ
>>
>>
>>
>>
>>
>>
>>
>> --
>> Txauth mailing list
>> [email-masked]
> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm> [image:
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> review, use, distribution or disclosure by others is strictly prohibited..
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*--
> Txauth mailing list
> [email-masked]

---

From: Justin Richer <[email-masked]>
Date: Tue, 24 Mar 2020 09:21:06 -0400

So …. OAuth 3? :)

> On Mar 23, 2020, at 5:59 PM, Leif Johansson <[email-masked]> wrote:
>