Re: [OAUTH-WG] Alexey Melnikov's No Objection on draft-ietf-oauth-device-flow-11: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi William,

On Thu, Aug 2, 2018, at 7:18 PM, William Denniss wrote:
> Alexey,
> 
> Thank you for your feedback. Replies inline:
> 
> On Sun, Jul 29, 2018 at 9:26 AM, Alexey Melnikov
> <[e-mail]> wrote:>> 
>> ---------------------------------------------------------------
>> ------->>  COMMENT:
>>  ----------------------------------------------------------------
>>  ------>> 
>>  This is generally a fine document and it was easy to follow.
>> 
>>  I am agreeing with Benjamin's DISCUSS about amount of entropy in
>>  codes.> 
> Understood, we are working on this.
>  
>> 
>> In addition, the last para in Section 6.1 reads:
>> 
>>     The server should ignore any characters like punctuation that are
>>     not>>     in the user-code character set.  Provided that the character set>>     doesn't include characters of different case, the comparison
>>     should>>     be case insensitive.
>> 
>>  This makes me uncomfortable, because you are talking of case-
>>  insensitivity,>>  without fully specifying what it is. I assume that your advice only>>  applies to user-code character sets which only use subset of ASCII?>>  Because if you mean to extend your advice to full Unicode, you need
>>  more text>>  and references here. Can you please clarify.
> 
> Version -12 updates this section.  It now reads, in part:
> 
>    For codes using only characters in the A-Z range as with the base-
>    20 charset defined above, the user's input should be upper-cased
>    before comparison to account for the fact that the user may input
>    the equivalent lower- case characters.
This is much better, thank you!