[OAUTH-WG] draft-ietf-oauth-v2-threatmodel-00 posted
Torsten Lodderstedt <torsten@lodderstedt.net> Fri, 01 July 2011 20:22 UTC
Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1299B11E8181 for <oauth@ietfa.amsl.com>; Fri, 1 Jul 2011 13:22:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.949
X-Spam-Level:
X-Spam-Status: No, score=-1.949 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, HELO_EQ_DE=0.35]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PJV1xUwDX3pk for <oauth@ietfa.amsl.com>; Fri, 1 Jul 2011 13:22:06 -0700 (PDT)
Received: from smtprelay04.ispgateway.de (smtprelay04.ispgateway.de [80.67.31.38]) by ietfa.amsl.com (Postfix) with ESMTP id D0ACD11E808A for <oauth@ietf.org>; Fri, 1 Jul 2011 13:22:05 -0700 (PDT)
Received: from [79.253.51.135] (helo=[192.168.71.35]) by smtprelay04.ispgateway.de with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.68) (envelope-from <torsten@lodderstedt.net>) id 1QckE0-0004ud-2B for oauth@ietf.org; Fri, 01 Jul 2011 22:22:04 +0200
Message-ID: <4E0E2C6C.805@lodderstedt.net>
Date: Fri, 01 Jul 2011 22:22:04 +0200
From: Torsten Lodderstedt <torsten@lodderstedt.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.18) Gecko/20110616 Thunderbird/3.1.11
MIME-Version: 1.0
To: OAuth WG <oauth@ietf.org>
Content-Type: text/plain; charset="ISO-8859-15"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Df-Sender: torsten@lodderstedt-online.de
Subject: [OAUTH-WG] draft-ietf-oauth-v2-threatmodel-00 posted
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Jul 2011 20:22:07 -0000
Hi all, I just posted the new revision of the OAuth 2.0 security threat model and considerations document as WG item (http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-00). We incoporated all feedback we got on the list and at IETF-80. Many thanks to all people who have given us feedback. Special thanks to Hui-Lan Lu, Francisco Corella, Eric Pflam, Shane B Weeden, Skylar Woodward, and James H. Manger for their comments and suggestions. New threats descriptions: - User session impersonation - XSRF - Clickjacking - DoS using manufactured authorization codes Modification: - renamed "session fixation" to "authorization code disclosure through counterfeit client" regards, Torsten.
- [OAUTH-WG] draft-ietf-oauth-v2-threatmodel-00 pos… Torsten Lodderstedt