Re: [OAUTH-WG] why are we signing?

I think there are multiple positions here.  Just to be clear, my position
is:

A combination of optional TLS, required bearer tokens, and optional token
rotation (refresh) is sufficiently secure and deployable.  I believe that
mandatory TLS would unacceptably reduce deployability (and mandatory
dependence on certificate chains more so).

--
John Panzer / Google
jpanzer@google.com / abstractioneer.org / @jpanzer

On Wed, Dec 2, 2009 at 11:57 AM, Mike Malone <mjmalone@gmail.com> wrote:

> On Tue, Dec 1, 2009 at 6:58 PM, Peter Saint-Andre <stpeter@stpeter.im>
> wrote:
> > <hat type='individual'/>
> >
> > On 11/30/09 1:27 PM, Eran Hammer-Lahav wrote:
> >> OAuth is being proposed as a generally useful method for securing API
> >> calls. I expect many open source libraries to implement it on the
> >> server side and use it for blog plugins, widgets, and other highly
> >> distributed software. If OAuth required the use of TLS, it would
> >> simply be ignored by all those applications which will likely
> >> continue using Basic.
> >>
> >> With all due respect to big companies, their resources, and ability
> >> to effortlessly deploy SSL/TLS, it is still an expensive and complex
> >> process for more developers deploying small scale server components.
> >
> > With all due respect, I think it can be harder for big companies to
> > deploy TLS -- they have a lot more users, need more hardware (special
> > SSL accelerators and the like), have more layers of employees (so it can
> > be more difficult to find the person who controls the hostmaster or
> > whois-listed email address), etc.
> >
> > Getting a Class 1 cert from the likes of StartSSL is easy as pie these
> > days. IMHO there is no excuse for not deploying SSL if you care one whit
> > about security. The problem is that too many small-scale developers (and
> > big companies!) simply don't care.
>
> I'm far from an expert on TLS/PKI, but here's a thought (and I'm
> pretty sure this has come up before)... If TLS is simpler than
> signatures then why not just use PKI for everything. A lot of the
> problems that have come up with OAuth are solved by PKI - client certs
> replace tokens, you can delegate authority by creating
> sub-certificates, the consumer provisioning problem is largely solved,
> etc.
>
> It seems like WRAP is using bits of PKI to solve half of the problem
> and then re-inventing other bits of PKI for the other half. If TLS/PKI
> is the solution, why not go whole hog?
>
> Mike
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>