Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner Impersonation)

["Lodderstedt, Torsten" <[e-mail]>]

>I've read the thread leading to this, and the proposed text and I do not understand the attack. Can you >provide a step-by-step scenario of how an attacker gains access?

I'm honestly surprised you do not understand the attack. The client simply uses screen scraping on the authorization flow and programmatically "presses" the right buttons. This obviously only works if the client can predict the form structure and expected input values.

>Also, it is unlikely that any major provider is going to require CAPCHA as part of the authorization flow. >This is especially true in the case of using OAuth for login which has to be practically transparent (one >click). I would hate to recommend a solution that no one is going to take seriously.

This text has been proposed by 2 WG members (Niv and me), and reviewed by 3 others (Phil, Tony, Barry) and all agree with it. What is the foundation of your strong assessment?

The text proposes three classes of countermeasures (detect source, prevent using unpredictable input, inform resource owner and give her a chance to revoke). CAPTCHAs are one out of three examples given for unpredictable input. So I don't understand why your objection focuses on it. The selection of the appropriate countermeasure is the task of the service provider and it will most likely depend this on its capabilities, cost, user experience, and risk/impact associated with abuse. CAPTCHAs (and even one time passwords) might not be the choice for the average internet service. This will be completely different if OAuth is used to process payment transactions.

>I'm keeping this proposed text out until we resolve this questions.

See above - I probably misunderstand the IETF process, but several people agreed with it and no one (except you) objected. Why do you hold it back? 

regards,
Torsten.

EHL


> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Torsten Lodderstedt
> Sent: Friday, August 12, 2011 7:56 AM
> To: [e-mail]
> Subject: [OAUTH-WG] Draft 20 last call comment (Resource Owner
> Impersonation)
> 
> Hi all,
> 
> I think the impersonation issue as raised by Niv on the list should be covered
> by the core spec. It directly aims at the trustworthiness of the user consent,
> which in my opinion is one of the core principles of OAuth. I therefore
> suggest to add a description to section 10.
> 
> Please find below the text Niv and I prepared. In comparison to  Niv's original
> proposal, it covers resource owner impersonation for all client categories.
> 
> regards,
> Torsten.
> 
> proposed text:
> 
> 10.<to be determined> Resource Owner Impersonation
> 
> When a client requests access to protected resources, the authorization flow
> normally involves the resource owner's explicit response to the access
> request, either granting or denying access to the protected resources.
> 
> A malicious client can exploit knowledge of the structure of this flow in order
> to gain authorization without the resource owner's consent, by transmitting
> the necessary requests programmatically, and simulating the flow against the
> authorization server. An suthorization server will be vulnerable to this threat,
> if it uses non-interactive authentication mechanisms or split the authorization
> flow across multiple pages.
> 
> It is RECOMMENDED that the authorization server takes measures to ensure
> that the authorization flow cannot be simulated.
> Attacks performed by scripts running within a trusted user-agent can be
> detected by verifying the source of the request using HTTP referrer headers.
> In order to prevent such an attack, the authorization server may force a user
> interaction based on non-predictable input values as part of the user consent
> approval.
> 
> The authorization server could combine password authentication and user
> consent in a single form, make use of CAPTCHAs or one-time secrets.
> 
> Alternatively, the authorization server could notify the resource owner of
> any approval by appropriate means, e.g. text message or e-Mail.
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/oauth