Assessing the negative effects of proposed standards

Andrew Campling <andrew.campling@419.consulting> Mon, 01 March 2021 11:09 UTC

Return-Path: <andrew.campling@419.consulting>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C84B13A19FF; Mon, 1 Mar 2021 03:09:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.998
X-Spam-Level:
X-Spam-Status: No, score=-4.998 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cv8EPiGzVRbP; Mon, 1 Mar 2021 03:09:13 -0800 (PST)
Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110088.outbound.protection.outlook.com [40.107.11.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13B953A19FD; Mon, 1 Mar 2021 03:09:11 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NS6uSeRlXs/JVllT0eGH68bbm+FfKaNtX2gLvn1ENze7vzFiU2mmaYF9FmLWDY8vG/K5/XWpbxuJKiT+fw9NBZkhPYkzAN7Pt2Cyd8UDNtYEYlHDuvrX2r5hlHTQMsTyOCqLCnES+BsLGoQ1WhdnLj3VAsf5ejST88BNcf+zQg27fDJPOUAb/WcCIDe1NtYq9YC7dcWUNKh+e4znj5UuiYsB2xJQ1JYxAbvCR8lN7n17iVFpw3asvsnBcN+NVfR8SoAMolG4dwRJitFwKvpxxT7vihPhY3Vs3NSfAYLLlt8R5mCeg0TNQOFTUFcRt9sJtq3P11H6GD8xhFsKHHLx/A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VnlBq/97vOoNbohoWyUHPJ9P+pDIhtyUIFG4dZMvsaw=; b=GAyA0ayoXX02ciLJVfjQmkszzl0j31gGoZFxxfYd8lS+u1sgk+PsqDnGkfBXuUSc7kCO/X7wVZBN2rhalk9LmzbElR2cEAB2QMxBqw6BZ4YNt2wqpJu61iAvYGZZ4OMgCg+TfXvLO86A5DepC636y3gsyhrC5fPflpriCeQxypFWgkHwMyxdLN9jmRtcIHicCvT1DAERWe6jVBSuGGuT9lS9JjfBXlJb6aBCSNMJeyVs7um1jfAM2yGI6/M6GvRYxbNh99iYAAiDcL8lbXcZtn5YpjBU8Q/exnTDe26xcLzB+LN5Vke6/bkTr76JHinl8X/mQ29s+wqVW5VDCXnFNA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VnlBq/97vOoNbohoWyUHPJ9P+pDIhtyUIFG4dZMvsaw=; b=phVn0Jy1slr+lx0d+RgQPBjAI8InzCztdygc88ReDy+mrFgRSN8AwOB/pOJOgbvaAovBFPGfAV+vi9gGPjFNvQLrmvF9WIqZwY+QK1FZdHK5hrXAA3o7keCuG+Ky2dJoma/51aMcXHwBsCQ9sSSvhix4TVPEOKaL8TX2YX7Vqc0=
Received: from CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM (2603:10a6:401:b::21) by CWXP265MB0392.GBRP265.PROD.OUTLOOK.COM (2603:10a6:401:3::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3890.28; Mon, 1 Mar 2021 11:09:09 +0000
Received: from CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM ([fe80::f1c8:80ec:e76c:945a]) by CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM ([fe80::f1c8:80ec:e76c:945a%3]) with mapi id 15.20.3868.033; Mon, 1 Mar 2021 11:09:09 +0000
From: Andrew Campling <andrew.campling@419.consulting>
To: Vittorio Bertola <vittorio.bertola@open-xchange.com>, Aaron Parecki <aaron@parecki.com>
CC: IETF-Discussion Discussion <ietf@ietf.org>, "oauth@ietf.org" <oauth@ietf.org>
Subject: Assessing the negative effects of proposed standards
Thread-Topic: Assessing the negative effects of proposed standards
Thread-Index: AdcOi0xAUGaB2r7aR1mFwetu7fvFTw==
Date: Mon, 1 Mar 2021 11:09:09 +0000
Message-ID: <CWXP265MB0566C4B21C45E760B1BFED7FC29A9@CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: open-xchange.com; dkim=none (message not signed) header.d=none;open-xchange.com; dmarc=none action=none header.from=419.consulting;
x-originating-ip: [86.144.96.155]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 9565da26-587e-4605-efff-08d8dca2700f
x-ms-traffictypediagnostic: CWXP265MB0392:
x-ms-exchange-minimumurldomainage: ietf.org#9487
x-microsoft-antispam-prvs: <CWXP265MB0392C082EBDF48291B184E96C29A9@CWXP265MB0392.GBRP265.PROD.OUTLOOK.COM>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 3UW1ZfTZ9Fyh4/0CcXNiw/MVn3xQBWt7pfOOL2q1pd1+1GIUwOCeqkykhj+jt3ROT81myiAfd6qt9EiT7okUpbUXxeS7Tz5Ea0cTw+yr2VsmJggxRUT2q1sjjjs8CWXSs6o1U+wvJ1Yqvt4f64PGA35wIFIkEaTWBg4sdcaHiCwHfFEvyfe0SgiL0wFqPl6gF5Fdv2u7wi9SzOA6isFeZOTcvjnAi4OLnQDCJV78gFyWFxMoNiobO1F3NVAYU/kTyu4LiUMXmdyZjjRO5J3fmYJz+68uxWLWuf8OnM8Q12AJRR8xYeHqYmfYohEddDtqLbrZIAgAbRdCXLRJ3Ogm4JplmpfBBQRAq8rrMvGLl3ByFzM59WiR76DI+P2iL24aD/Wyc+URcZgyXjAKuN2Rs6XMtnZdpdtgap+QJOl2sh+0E1AA66SJHR4TAHom2913n1SiDjE8gt2kegXKtGja1AaYRu0bD8O1LYpHZr4JpgXAr3LNbdQUFdG+KCLvxli9WI2MEBqObIxFBExpnoKYbZwOv1geKny/rBRP/Iqb5G+bSX0GxQAUI/gNhZ9GILrRXOYe6dH2pQVy25UXhOT5ONVLOJqKWZD2fzAT70yYkkULe73yRzxKifOlMr2QydqVGIpK029RzzD/ofoLVq6/xA==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(39830400003)(396003)(376002)(366004)(346002)(136003)(7696005)(4326008)(110136005)(2906002)(54906003)(4743002)(52536014)(66574015)(316002)(166002)(83380400001)(66946007)(86362001)(66446008)(66476007)(66556008)(64756008)(5660300002)(53546011)(76116006)(6506007)(8676002)(55016002)(33656002)(71200400001)(966005)(186003)(478600001)(26005)(44832011)(9686003)(8936002)(46492009); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: =?utf-8?B?UWNlTStlWEhodVNMU0w4eDd2MXY2cHBKMzJOb2MzTTlhc0Y5Y3hJVXFqSW00?= =?utf-8?B?Y2lCNUNIY1k0eVRrR1JveDBONm1sUmlRK0NKOW9wRGtTelMyMkllRHdFdXRw?= =?utf-8?B?cU1MUHFxZFdUaWMvRnJqc2ljQjVPc2ltWW50MTJ5d0p3MzJpS3h4eGs2UUo0?= =?utf-8?B?Ym9LeHpYeEZTeDJPVHJNUW1hN3FnR3RDZE9TbjBUVVBUVm9LSzNYTjBZdTlI?= =?utf-8?B?MHpVZ1hlNndNcHNhd0F5Z2k3NWJSZGJSODVkQ1ZCSlo4REl6WEg4cmE5eUZR?= =?utf-8?B?dWF4SUdrOE1OaHhyb25DdTZYQTd5RjhJY3FDWUxDaGNMa29JOWJGOTVPTlFS?= =?utf-8?B?MTlrTktXSUhmWWZaSVlQa1hvdkxsMFBIWTVJYzBNNGNDb0lFOWRIVUdnSjhJ?= =?utf-8?B?cjVWLzFiVnNPR1dFWm9zNGZhb0Z1d28wanJQYUVwYmF2M0tudmFTTUtIOTlX?= =?utf-8?B?NFUreE9TU1ZTckppYjVJSDRxRHAwdUV3QkljOVcrQjl2Z3ppd0lUYy96TXlj?= =?utf-8?B?bCsxczB0TGY4T3dkUFh6cnNuakpGdjlPdGxpczl3YzFLNklrV0pqemRhNHVO?= =?utf-8?B?RTFzNDdjeGJYZ0VGTUFZWnRNaTNBQ1Mwc1Nka0hNS0RIVTc4V3JVck00c0Jn?= =?utf-8?B?VWRtaFZ6QkhSVVlSaEZiS3ExS2x1WGJxVnZmajVIM0dxVWlWYStQaTZxMy9I?= =?utf-8?B?N21vNVI4TkRzNkxJOHNSK1ZVSDJMdEJjUEx4d1VwVUpZd1h4YkRlWjZCanZ5?= =?utf-8?B?RzZiMG8zOTVseEJ4cUc2OC92c2NlNHg2MTZqVzlndWhGR3FKSDFqZ09IOElz?= =?utf-8?B?QjJWZU1LenE3SDBRWWU0MXdPQnBDY1RmMDBnazhvNHNWUEUrRzZXRk15dmh1?= =?utf-8?B?RllldXV0S2tMa0lHbnMrVmFRVldqemdUaHVmOTYya2xPQTZ3K1FGM0M5V1ov?= =?utf-8?B?RVpjaTV5MnVEMkRwTm0waVBHZTFJSDVtMk5IdVNOZ2RmR0VTUmMwL0xUWHRt?= =?utf-8?B?cUhaMXBtK21PMU52U2gyVG9xS0NYbVN4aE93a0pKUkZyVytsSnh0QVpmTjVN?= =?utf-8?B?Qys2MFhZeGVBa3Z4TFF3LzdyanBpSzlqVlg1ekF3VHc4TkJWYTYyMks4NG1N?= =?utf-8?B?cTl6MlJSUVo3YVFnMVhaOTM5aE9mcEQ3YVVRV0RKblBqM0tmSWFNdXNzTGpa?= =?utf-8?B?akVkbjJkTG1NQ1lTTEVuYXRRNS9iQUpobEFMN0ZtRkdjT056ZFFIcThMa3pr?= =?utf-8?B?RmdUckhiMm9NVEJOak1SaWpPWld6dlJNRlIveWJGMDBmUC9iTUVNN1Z3OUZv?= =?utf-8?B?aU1VNDl3Q3Z4UjBXV2oxS3YzankvS2FWaWY2QndmREpuUGNJNzlHamtqT2RB?= =?utf-8?B?VExpU2JBMWlXcW9BWkdTOFhoOTFBcHQ0eWtOa1NJOHlyNDJSSzBPSlhqY0Iz?= =?utf-8?B?bUV4ZVcxcENhRUNDMmpSRGt5YThoa2RHSzk3WmRrMWFSM0FYUUlUa3JkYyt1?= =?utf-8?B?d21oVStZUDROcjFWV2pId3ZObkdCTGxNUkdXMzZ2a1B1NXFkU0tnZ1cvandm?= =?utf-8?B?UThsRUgxRFU3WmowcUVyVlJpUEpRZzdMWmhUQkxPaTgvNHlOM2pxSXhXckd4?= =?utf-8?B?VlJha08yZ3BiSUI1RWZjY2Q3cHNOYXkwVkpWOWpiRXhYRkFGTnZlb1ZDR3BR?= =?utf-8?B?RndWOVZ0RFYyaU9iOVpHUlBLMmd0MGllYWdyWmNHSWVyZXBkbCtIRTZJRDNw?= =?utf-8?Q?Us9/fVrmNqdbYTzxeU=3D?=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_CWXP265MB0566C4B21C45E760B1BFED7FC29A9CWXP265MB0566GBRP_"
MIME-Version: 1.0
X-OriginatorOrg: 419.consulting
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 9565da26-587e-4605-efff-08d8dca2700f
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2021 11:09:09.5160 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: PEcMQW28LZ6XjCVzaFJytYlxGqmfyzztyCu0dLazVW4a5EUthHdDy1/EvCUstoHGup3dwLlAUFxCdh9M0SyV6KwPYjTP8DWNDpBssEecXEo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWXP265MB0392
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/3jhTlFwLrhPu09hAnHMwmvG_If8>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Mar 2021 11:09:18 -0000

On 01/03/2021 10:44 Vittorio Bertola <vittorio.bertola@open-xchange.com<mailto:vittorio.bertola@open-xchange.com>> wrote:

> Il 26/02/2021 17:32 Aaron Parecki <aaron@parecki.com<mailto:aaron@parecki.com>> ha scritto:


>> Dynamic client registration does exist in OAuth: https://tools.ietf.org/html/rfc7591

>> The point is that basically nobody uses it because they don't want to allow arbitrary client registration at their ASs. That's likely due to a combination of pre-registration being the default model in OAuth for so long (the Dynamic Client Registration draft was published several years after OAuth 2.0), as well as how large corporations have decided to run their ASs where they want to have (what feels like) more control over the things talking to their servers.

> This is indeed a matter of product design. I am active in an OIDC-based open identity project where the specs say that providers MUST accept dynamic client registration, without a pre-determined client secret. This is the only way to create a federation that can work on an Internet scale, with relying parties accepting identities managed by providers unknown to them. Then, of course, this also creates lots of opportunities for abuse: you end up in an email-like scenario in which you need ways to ascertain trust in unknown parties and decide whether you want to accept interoperating with them and believe the information they provide, which in turn depends a lot on your specific use case. But we think that that is preferrable to the centralization that is inherent in the original registration model.


I wonder whether proposed standards should be assessed for their negative properties, eg whether they are likely to exacerbate centralisation, much like security aspects are reviewed.  It may be that a given proposal might still go forward as the trade-offs are deemed worthwhile, however, they would at least be understood and, ideally, documented.  At present there seems to be an exorable drift towards centralisation which, in my view, has a detrimental impact on both resilience and privacy.  Such developments may satisfy the needs of their proponents but are unlikely to be in the long-term interests of end-users (RFC 8890) and, therefore, it would be helpful if this trend wasn’t made worse by the introduction of new standards.


Andrew Campling