Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations
Torsten Lodderstedt <torsten@lodderstedt.net> Thu, 10 January 2013 06:29 UTC
Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFC0121F8698 for <oauth@ietfa.amsl.com>; Wed, 9 Jan 2013 22:29:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.248
X-Spam-Level:
X-Spam-Status: No, score=-2.248 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EI8rcOG62s6F for <oauth@ietfa.amsl.com>; Wed, 9 Jan 2013 22:29:15 -0800 (PST)
Received: from smtprelay02.ispgateway.de (smtprelay02.ispgateway.de [80.67.31.29]) by ietfa.amsl.com (Postfix) with ESMTP id 0817721F8681 for <oauth@ietf.org>; Wed, 9 Jan 2013 22:29:14 -0800 (PST)
Received: from [80.187.97.83] (helo=[100.90.146.180]) by smtprelay02.ispgateway.de with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.68) (envelope-from <torsten@lodderstedt.net>) id 1TtBdU-0006TV-Pl; Thu, 10 Jan 2013 07:29:10 +0100
Date: Thu, 10 Jan 2013 07:29:05 +0100
Message-ID: <p4xlte9sx1lumup8sgw6l9wy.1357799345883@email.android.com>
Importance: normal
From: Torsten Lodderstedt <torsten@lodderstedt.net>
To: Michael.Jones@microsoft.com, phil.hunt@oracle.com, mark.mcgloin@ie.ibm.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="--_com.android.email_1399802362359170"
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC1vbmxpbmUuZGU=
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Torsten Lodderstedt <torsten@lodderstedt.net>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Jan 2013 06:29:17 -0000
Thanks! Mike Jones <Michael.Jones@microsoft.com> hat geschrieben:Congratulations on this achievement, guys! -- Mike -----Original Message----- From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of rfc-editor@rfc-editor.org Sent: Monday, January 07, 2013 1:40 PM To: ietf-announce@ietf.org; rfc-dist@rfc-editor.org Cc: oauth@ietf.org; rfc-editor@rfc-editor.org Subject: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations A new Request for Comments is now available in online RFC libraries. RFC 6819 Title: OAuth 2.0 Threat Model and Security Considerations Author: T. Lodderstedt, Ed., M. McGloin, P. Hunt Status: Informational Stream: IETF Date: January 2013 Mailbox: torsten@lodderstedt.net, mark.mcgloin@ie.ibm.com, phil.hunt@yahoo.com Pages: 71 Characters: 158332 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-oauth-v2-threatmodel-08.txt URL: http://www.rfc-editor.org/rfc/rfc6819.txt This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the OAuth 2.0 protocol. This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Web Authorization Protocol Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and… rfc-editor
- Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model… Mike Jones
- Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model… Hannes Tschofenig
- Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model… Torsten Lodderstedt