Re: [OAUTH-WG] why are we signing?

[Peter Saint-Andre <[e-mail]>]

On 12/3/09 3:21 PM, Stephen Farrell wrote:
> 
> 
> On 3 Dec 2009, at 21:40, Peter Saint-Andre <[e-mail]> wrote:
> 
>> <hat type='chair'/>
>>
>> On 12/2/09 2:48 AM, Stephen Farrell wrote:
>>> I think we'll need an analysis of where we end up wanting TLS
>>> for the protocols we produce. I wouldn't expect any big
>>> surprises, but right now I don't think we can be sure since
>>> things seems to be in flux to some extent.
>>>
>>> Then, I'd be for saying that TLS MUST be used for those operations.
>>> However, I can well believe that there may be some niches where
>>> using TLS isn't easy, so I could live with something like: it MUST
>>> be possible to use TLS, and that deployments SHOULD use it, with
>>> guidance as to the type of scenario where we think TLS really
>>> has to be turned on, and maybe text about why sometimes people
>>> can't do that.
>>>
>>> So I don't think we can finish this discussion at this stage.
>>
>> I think we can:
>>
>> 1. Software MUST implement TLS
>> 2. Services should deploy TLS
> 
> Tend to agree. What I meant we couldn't yet do was say for exactly which
> operations we think TLS should be turned on, and what it means to not
> use TLS in those cases,

Agreed. I think we'll have a clearer picture of that in the next few
weeks, once the token auth and alternative delegation flow I-Ds are
submitted.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/