Re: [OAUTH-WG] why are we signing?

[Peter Saint-Andre <[e-mail]>]

<hat type='individual'/>

On 11/30/09 1:27 PM, Eran Hammer-Lahav wrote:
> OAuth is being proposed as a generally useful method for securing API
> calls. I expect many open source libraries to implement it on the
> server side and use it for blog plugins, widgets, and other highly
> distributed software. If OAuth required the use of TLS, it would
> simply be ignored by all those applications which will likely
> continue using Basic.
> 
> With all due respect to big companies, their resources, and ability
> to effortlessly deploy SSL/TLS, it is still an expensive and complex
> process for more developers deploying small scale server components.

With all due respect, I think it can be harder for big companies to
deploy TLS -- they have a lot more users, need more hardware (special
SSL accelerators and the like), have more layers of employees (so it can
be more difficult to find the person who controls the hostmaster or
whois-listed email address), etc.

Getting a Class 1 cert from the likes of StartSSL is easy as pie these
days. IMHO there is no excuse for not deploying SSL if you care one whit
about security. The problem is that too many small-scale developers (and
big companies!) simply don't care.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/