Re: [OAUTH-WG] why are we signing?

Counter-argument:  The login pages are protected with https, so their
password is protected.  Their session cookies are sent in clear text but are
themselves encrypted and are refreshed every (say) 10 minutes to minimize
exposure from leakage.  The user's data certainly is sent in clear text form
and an attacker can both read it and impersonate the user to send data if
they grab the cookies, at least for 10 minutes.  So I got nothin' there.

(Would bearer token plus a way to securely rotate the token every N minutes
make the OAuth session at least as secure as the above scenario?)

On Mon, Nov 9, 2009 at 4:27 PM, Brian Eaton <beaton@google.com> wrote:

> On Sun, Nov 8, 2009 at 11:48 PM, Eran Hammer-Lahav <eran@hueniverse.com>
> wrote:
> > The problem is, we are not likely to ever reach consensus on 'reasonable
> security'.
>
> Agreed, we are going to need a couple of options to cover even the
> most vanilla use cases.  I fully expect other people to come up with
> more options for their specific use cases.
>
> My goal with this conversation is to identify the vanilla use cases
> that would cover most applications.
>
> > For example, I don't find most cookie-based session systems reasonably
> secure without SSL/TLS.
> > Being able to sit at a coffee shop with free wifi and a laptop and steal
> sessions cookies, then access
> > people's email for the duration the cookie is valid isn't reasonable or
> secure.
>
> OK, so let's consider OAuth-authenticated access to such a service...
> does signing requests improve security?
>
> I don't think so.  The user's password is going to be sent in
> clear-text when they log in to the service to approve the oauth token.
>  And whenever they view a web page on the service their session
> cookies are sent in clear text.  The user's data (which is what really
> matters in this whole discussion...) is sent in clear text.
>
> AFAICT, using HMAC-SHA1 or RSA-SHA1 in such an environment doesn't
> protect users that much.  The service really needs to support https if
> they are concerned about that threat model.
>
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
--
John Panzer / Google
jpanzer@google.com / abstractioneer.org / @jpanzer