Re: [OAUTH-WG] why are we signing?

[Brian Eaton <[e-mail]>]

On Tue, Dec 1, 2009 at 11:21 AM, George Fletcher <[e-mail]> wrote:
> In addition to the use case Mike gave, I have seen at least two other use
> cases of having the "proxy" sign the URL and then present over HTTP.
> 1. an iGoogle gadget that wants to launch an iframe with a URL that carries
> specific identity & authorized rights
> 2. a rich/desktop application want to launch a browser in an
> authenticated/authorized state (i.e. client-to-browser SSO)

OK, so now we're up to 7 (8?) different use cases where "OAuth"
signatures are being used.  Some others are listed here:

http://www.ietf.org/mail-archive/web/oauth/current/msg00544.html

... most of them still inventing their own signature base strings,
which I find either amusing or tragic depending on my mood. =)

> I also haven't seen anyone bring up the "restricted device" use case yet:) I
> do work with a product team that refuses to use SSL because of the memory,
> load time, and CPU requirements.

So what do these folks deem to be acceptable, security-wise?

(I'll put my money on "short-lived bearer token that is automatically
refreshed at intervals"... =)

> Curious if any in the mobile device
> environment see the requirement of SSL an issue? Potentially not given most
> devices these days have a browser.

I hear this now and again, but every time I've looked at it seriously
it's turned out to be a non-issue.

Cheers,
Brian