Re: [OAUTH-WG] WGLC on draft-ietf-oauth-v2-threatmodel-01, ends 9 Dec 2011

Michael Thomas <> Mon, 16 January 2012 16:04 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A608421F8694 for <>; Mon, 16 Jan 2012 08:04:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.589
X-Spam-Status: No, score=-2.589 tagged_above=-999 required=5 tests=[AWL=0.010, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id defbmmnsiAzp for <>; Mon, 16 Jan 2012 08:04:00 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 261E421F8693 for <>; Mon, 16 Jan 2012 08:04:00 -0800 (PST)
Received: from ( []) (authenticated bits=0) by (8.14.3/8.14.3) with ESMTP id q0GG3sD2023635 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Mon, 16 Jan 2012 08:03:55 -0800
Message-ID: <>
Date: Mon, 16 Jan 2012 08:03:54 -0800
From: Michael Thomas <>
User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv: Gecko/20090605 Thunderbird/ Mnenhy/
MIME-Version: 1.0
To: Mark Mcgloin <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <4F04BF70.3 <90C41DD21FB7C64BB94121FBBC2E723453A72D09B9@P3PW5EX1MB01.EX1.SECURESERVER.NET> <OF8B311AA2.ACF026F4-ON8025797C.00460040-8025797C.004D16DC <> <>
In-Reply-To: <>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1743; t=1326729836; x=1327593836; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version;;; z=From:=20Michael=20Thomas=20<> |Subject:=20Re=3A=20[OAUTH-WG]=20WGLC=20on=20draft-ietf-oau th-v2-threatmodel-01,=20ends=209=0A=20Dec=202011 |Sender:=20 |To:=20Mark=20Mcgloin=20<> |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=oJuHUQoaL7eOBctkiGgGypRMqsd9lDxPnsUV+J978U0=; b=snfQKuJBU9giFdWR/4u8zoSfWSxozDyxvGZKo2ec3lCt91cTM5j2x4nzoi zbhPfY48bL52M3s1g+D04pcKqi+kmKa2BoQhvxhXKjTtK5uIQ+Zmqcsf0d5g tPpzzbAWPPPPQzz1GLMpeQiAtwzGLkb4TXnPIrPe4AlcgUGeHToxY=;
Authentication-Results: ; v=0.1; dkim=pass ( sig from verified; ); dkim-asp=pass
Cc: OAuth WG <>
Subject: Re: [OAUTH-WG] WGLC on draft-ietf-oauth-v2-threatmodel-01, ends 9 Dec 2011
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 16 Jan 2012 16:04:00 -0000

On 01/16/2012 05:52 AM, Mark Mcgloin wrote:
> Countermeasures:

First off the title: it says Countermeasures. Therefore, anything here
must be a real and meaningful "countermeasure".

> 1. The OAuth flow is designed so that client applications never need to
> know user passwords. Client applications SHOULD avoid directly asking users
> for the their credentials.

This is not a countermeasure. It is a request that bad guys be good.

Strike it entirely.

> In addition, end users could be educated about
> phishing attacks and best practices, such as only accessing trusted
> clients, as OAuth does not provide any protection against malicious
> applications and the end user is solely responsible for the trustworthiness
> of any native application installed

This is not a credible countermeasure. End users know nothing
about this, and I'd venture to say that includes you and me too.

Strike it entirely.

> 2. Client applications could be validated prior to publication in an
> application market for users to access. That validation is out of scope for
> OAuth but could include validating that the client application handles user
> authentication in an appropriate way

This may be a valid countermeasure, but there needs to be some
reason to believe that it is not just a hope and a prayer put here
just to feel good.

If it cannot be substantiated, strike it entirely.

> 3. Client developers should not write client applications that collect
> authentication information directly from users and should instead delegate
> this task to a trusted system component, e.g. the system-browser.

This is not a valid countermeasure. It expects bad guys to be good.

Strike it entirely.