Re: [oauth] Comment on charter

[Blaine Cook <[e-mail]>]

On Fri, Feb 6, 2009 at 8:04 PM, Lisa Dusseault <[e-mail]> wrote:
>   * Assure good security practice, or document gaps in its
> capabilities
>
> ...
>
> Change second bullet to:
> "* Assure good security practice, or document gaps in its
> capabilities, and propose a path forward for addressing the gap."
>
> ... We are learning over time
> that (1) documenting security gaps, combined with (2) a clear path to
> addressing gaps, and (3) work in progress to addressing gaps goes a long
> way to making less-than-best-security-practice specifications more
> acceptable.
>
> I.e. The charter change I propose is geared toward helping Oauth see the
> light of day more quickly, and have an incremental path toward
> best-practice security.

I fully agree. My approach to security, and I think this is true for
others involved with OAuth, is to strive for the best security that
will actually work. That is to say that if OAuth wasn't adopted
because the security introduced a too-high barrier to adoption, then
the reality is that everyone has less security overall since they're
using Basic auth or whatever other (less secure) alternative.

By pushing forward OAuth, we've educated people and informed
discussions around security, enabling people to think about even
better approaches, and as those conversations mature, we (as the web
community in general) should absolutely be active in ensuring that we
offer the best usable solutions possible.

b.