Re: [OAUTH-WG] Public client cloning

As Filip mentioned, I feel that claimed HTTPS URI would help. Further, if that is used within the dynamic client registration, it could be more secure.

The security assumptions are

1. Phone is not rooted;
2. App Store's vetting of claimed URI is not compromised; etc.

Nat Sakimura
Chairman, OpenID Foundation
https://nat.sakimura.org
2019年9月11日 4:27 +0900、Masakazu OHTSUKA <o.masakazu@gmail.com>のメール:
> I see.
>
> Then is this understandable to think from the Authorization Server's point of view ...
>
> If phone being compromised is a threat that the Client cares,
> AS might be interested in NOT supporting public Clients,
> and forcing the Client to have a server side, do client authentication, and have some way to hold a session between the native app and it's server side.
>
> Because if phone is compromised, when AS supports public Clients and access_token leaks, it's kind of AS's fault (well depending on the terms...),
> but if whatever the means that the phone app and it's server side keeps a session leaks, it's NOT the AS's fault.
>
>
> > On Tue, Sep 10, 2019 at 8:23 PM Marius Scurtescu <marius.scurtescu@coinbase.com> wrote:
> > > If the phone is compromised, original app replaced by malicious app, then RFC8252 will not help. The assumption is that the phone is not compromised.
> > >
> > > > On Tue, Sep 10, 2019 at 9:58 AM Masakazu OHTSUKA <o..masakazu@gmail.com> wrote:
> > > > > Hi,
> > > > >
> > > > > I've read rfc8252 and have questions about native apps, that I couldn't find answers on Internet.
> > > > >
> > > > > Imagine an attacker doing:
> > > > > 1. original app and authorization server conforms to rfc8252 4.1.  Authorization Flow for Native Apps Using the Browser
> > > > > 2. clone the original app, name it malicious app and install on the target phone
> > > > > 3. remove the original app from the target phone
> > > > > 4. use the malicious app and authorize, OS will invoke malicious app using custom URL scheme
> > > > > 5. now malicious app has access to the access token
> > > > >
> > > > > How should we think about this?
> > > > > What am I missing?
> > > > >
> > > > > _______________________________________________
> > > > > OAuth mailing list
> > > > > OAuth@ietf.org
> > > > > https://www.ietf.org/mailman/listinfo/oauth
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth