Re: [OAUTH-WG] why are we signing?

[Peter Saint-Andre <[e-mail]>]

<hat type='individual'/>

On 12/1/09 8:08 PM, Eran Hammer-Lahav wrote:
> 
>> -----Original Message----- From: Peter Saint-Andre
>> [mailto:[e-mail]] Sent: Tuesday, December 01, 2009 6:58
>> PM To: Eran Hammer-Lahav Cc: Tschofenig, Hannes (NSN - FI/Espoo);
>> ext Dick Hardt; [e-mail] Subject: Re: [OAUTH-WG] why are we
>> signing?
>> 
>> <hat type='individual'/>
>> 
>> On 11/30/09 1:27 PM, Eran Hammer-Lahav wrote:
>>> OAuth is being proposed as a generally useful method for securing
>>> API calls. I expect many open source libraries to implement it on
>>> the server side and use it for blog plugins, widgets, and other
>>> highly distributed software. If OAuth required the use of TLS, it
>>> would simply be ignored by all those applications which will
>>> likely continue using Basic.
>>> 
>>> With all due respect to big companies, their resources, and
>>> ability to effortlessly deploy SSL/TLS, it is still an expensive
>>> and complex process for more developers deploying small scale
>>> server components.
>> With all due respect, I think it can be harder for big companies to
>>  deploy TLS -- they have a lot more users, need more hardware
>> (special SSL accelerators and the like), have more layers of
>> employees (so it can be more difficult to find the person who
>> controls the hostmaster or whois-listed email address), etc.
> 
> Either way you are making my point, sorta.
> 
>> Getting a Class 1 cert from the likes of StartSSL is easy as pie
>> these days. IMHO there is no excuse for not deploying SSL if you
>> care one whit about security. The problem is that too many
>> small-scale developers (and big companies!) simply don't care.
> 
> Don't care, don't need that much security, don't understand it, etc.
> Bottom line is that requiring SSL is certain to fork this work if not
> done right.

o/~ don't know much about security... o/~

> And BTW, I was the one arguing for mandating SSL in 1.0 when
> obtaining tokens. I lost.

Right, because people are lazy.

In any case, if the big companies take the lead and require encrypted
connections, then everyone else will follow. This is more of a cultural
issue than a technical issue.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/