Re: [OAUTH-WG] why are we signing?

[Dick Hardt <[e-mail]>]

On 2009-12-01, at 5:46 PM, Brian Eaton wrote:

> On Tue, Dec 1, 2009 at 7:08 PM, Eran Hammer-Lahav <[e-mail]> wrote:
>>> Getting a Class 1 cert from the likes of StartSSL is easy as pie these
>>> days. IMHO there is no excuse for not deploying SSL if you care one whit
>>> about security. The problem is that too many small-scale developers (and
>>> big companies!) simply don't care.
>> 
>> Don't care, don't need that much security, don't understand it, etc. Bottom line is that requiring SSL is certain to fork this work if not done right.
> 
> Note, however, that someone who can't get SSL working and still
> deploys OAuth has basically no security against eavesdroppers or MITM
> attacks, and certainly can't expect OAuth to provide it.  The issues
> are in the token issuance phase: these organizations are sending user
> passwords and session cookies in clear text!  OAuth is the least of
> their security concerns,


If the cost of SSL outweighs the risk of a security breach, then why would a developer deploying OAuth choose to sign their messages rather then use the simpler bearer token?

Peter Saint-Andre questioned why SSL was required in OAuth WRAP. I think that is a good question. Perhaps it should be RECOMMENDED, and deployments can make their own benefit analysis.

-- Dick