Re: [OAUTH-WG] OAuth2 attack surface....
Dick Hardt <dick.hardt@gmail.com> Tue, 26 February 2013 01:42 UTC
Return-Path: <dick.hardt@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBF241F0D11 for <oauth@ietfa.amsl.com>; Mon, 25 Feb 2013 17:42:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.598
X-Spam-Level:
X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id guw-2LCZYqRO for <oauth@ietfa.amsl.com>; Mon, 25 Feb 2013 17:42:53 -0800 (PST)
Received: from mail-pa0-f48.google.com (mail-pa0-f48.google.com [209.85.220.48]) by ietfa.amsl.com (Postfix) with ESMTP id A337E21E8127 for <oauth@ietf.org>; Mon, 25 Feb 2013 17:42:53 -0800 (PST)
Received: by mail-pa0-f48.google.com with SMTP id hz10so2082036pad.21 for <oauth@ietf.org>; Mon, 25 Feb 2013 17:42:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:content-type:mime-version:subject:from:in-reply-to:date :cc:message-id:references:to:x-mailer; bh=/i9NJNFSHSW3tctsvCu2EbAjv6tsYPOuOl79/KKHmGU=; b=NVOx96ZtbwrqAME0Z676EdLCFR4d2vF2+ouyH2kBQB17oKzb+RIZzMZAAtbPlBi2jO /GLejbMw/lvHXtXyESzcLHkIKL7E9tEWAloLZQXyTayCy1RpJfTrKpyw5HFc/hBuUBAQ 4njoiAo+PXMsIGVyVzzK5LTf/lmPudNB85PofCAlUbnVzxApNYZXvjPTzXwRQT2I69IP dyDK3rWyyCm8eF4I+mtLxVU4U5EbPGPqA1T8k1irTt2Y03sPiZfhsgO4wXabrRHJMOYc Y55EMyBNrEMPSJZoMBvJDrTNI9I5wb+EavIbjsC5vWnfFN1FAq0r6mFW738Q6p5wIc1w sUcA==
X-Received: by 10.66.251.162 with SMTP id zl2mr22398866pac.36.1361842973487; Mon, 25 Feb 2013 17:42:53 -0800 (PST)
Received: from airstream.lan (S01061caff7df80fa.vc.shawcable.net. [24.85.86.234]) by mx.google.com with ESMTPS id hs8sm14505549pbc.27.2013.02.25.17.42.48 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 25 Feb 2013 17:42:51 -0800 (PST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_E7673573-BBBD-4563-8472-742E32E336EA"
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: Dick Hardt <dick.hardt@gmail.com>
In-Reply-To: <B33BFB58CCC8BE4998958016839DE27E068A104F@IMCMBX01.MITRE.ORG>
Date: Mon, 25 Feb 2013 17:42:05 -0800
Message-Id: <535B0BAF-DA71-4B8E-914C-1523714EF0C6@gmail.com>
References: <1361830944.13340.YahooMailNeo@web31812.mail.mud.yahoo.com> <E4A6D91D-2BC8-4F2E-9B1C-D1362A0E3608@oracle.com> <1361831644.50183.YahooMailNeo@web31801.mail.mud.yahoo.com> <1361832133.97884.YahooMailNeo@web31816.mail.mud.yahoo.com> <B33BFB58CCC8BE4998958016839DE27E068A104F@IMCMBX01.MITRE.ORG>
To: "Richer, Justin P." <jricher@mitre.org>
X-Mailer: Apple Mail (2.1499)
Cc: O Auth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth2 attack surface....
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Feb 2013 01:42:58 -0000
I once again kick myself for not noticing the implicit flow was inserted into the spec … hopefully the warning labels keep others from supporting the implicit flow … but additional messaging about not supporting implicit flow would be useful. I can see why Facebook wanted it for the content merging it provides, but it should likely have been a different API and authorization process. On Feb 25, 2013, at 2:58 PM, "Richer, Justin P." <jricher@mitre.org> wrote: > From my read, it's a combination of browser bugs (it only affects Chrome) and Facebook's insistence on using the Implicit flow for everything. > > While I don't at all care for the "sky is falling" rhetoric that seems to follow OAuth2, the author has some good suggestions for implementations: binding redirect URIs to particular flows, preference for the code flow, not using a default redirect_uri on a hosted domain with user-generated content. > > But all of these are implementation issues that the OAuth2 protocol can't really address directly. > > -- Justin > > > On Feb 25, 2013, at 5:42 PM, William Mills <wmills_92105@yahoo.com> wrote: > >> >> >> DOH!!! http://homakov.blogspot.co.uk/2013/02/hacking-facebook-with-oauth2-and-chrome.html >> >> From: Phil Hunt <phil.hunt@oracle.com> >> To: William Mills <wmills_92105@yahoo.com> >> Sent: Monday, February 25, 2013 2:28 PM >> Subject: Re: [OAUTH-WG] OAuth2 attack surface.... >> >> Whats the link? >> >> Phil >> >> Sent from my phone. >> >> On 2013-02-25, at 14:22, William Mills <wmills_92105@yahoo.com> wrote: >> >>> I think this is worth a read, I don't have time to dive into this :( >>> _______________________________________________ >>> OAuth mailing list >>> OAuth@ietf.org >>> https://www.ietf.org/mailman/listinfo/oauth >> >> >> >> >> _______________________________________________ >> OAuth mailing list >> OAuth@ietf.org >> https://www.ietf.org/mailman/listinfo/oauth > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] OAuth2 attack surface.... William Mills
- Re: [OAUTH-WG] OAuth2 attack surface.... William Mills
- Re: [OAUTH-WG] OAuth2 attack surface.... Richer, Justin P.
- Re: [OAUTH-WG] OAuth2 attack surface.... John Bradley
- Re: [OAUTH-WG] OAuth2 attack surface.... Dick Hardt
- Re: [OAUTH-WG] OAuth2 attack surface.... Antonio Sanso
- Re: [OAUTH-WG] OAuth2 attack surface.... prateek mishra
- Re: [OAUTH-WG] OAuth2 attack surface.... Oleg Gryb
- Re: [OAUTH-WG] OAuth2 attack surface.... John Bradley
- Re: [OAUTH-WG] OAuth2 attack surface.... prateek mishra
- Re: [OAUTH-WG] OAuth2 attack surface.... Antonio Sanso
- Re: [OAUTH-WG] OAuth2 attack surface.... prateek mishra