Re: [OAUTH-WG] WGLC on draft-ietf-oauth-v2-threatmodel-01, ends 9 Dec 2011

William Mills <wmills@yahoo-inc.com> Wed, 04 January 2012 23:43 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BDC311E8089 for <oauth@ietfa.amsl.com>; Wed, 4 Jan 2012 15:43:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.018
X-Spam-Level:
X-Spam-Status: No, score=-17.018 tagged_above=-999 required=5 tests=[AWL=0.580, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tfv5bMJs01i1 for <oauth@ietfa.amsl.com>; Wed, 4 Jan 2012 15:43:05 -0800 (PST)
Received: from nm3.bullet.mail.bf1.yahoo.com (nm3.bullet.mail.bf1.yahoo.com [98.139.212.162]) by ietfa.amsl.com (Postfix) with SMTP id 4E25111E80C1 for <oauth@ietf.org>; Wed, 4 Jan 2012 15:43:05 -0800 (PST)
Received: from [98.139.215.140] by nm3.bullet.mail.bf1.yahoo.com with NNFMP; 04 Jan 2012 23:42:57 -0000
Received: from [98.139.212.247] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 04 Jan 2012 23:42:57 -0000
Received: from [127.0.0.1] by omp1056.mail.bf1.yahoo.com with NNFMP; 04 Jan 2012 23:42:57 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 314030.22965.bm@omp1056.mail.bf1.yahoo.com
Received: (qmail 44293 invoked by uid 60001); 4 Jan 2012 23:42:56 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1325720576; bh=EFUQBEN8uPHI0auUojmNg1Mn/JvoSR6gvXjHHsRw16k=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Ls3dIwQO1sDCqFdOGtTXL4UDCAOUPNBinIg3TVEM1TJFUMoDrxrIeNOmOVbd9aJRL6qszV0+G3gNGZ34CqtvQsNmsufYlvOop7hykBBox4AmdeIoDOoeW982BAa6bxRMewB3Og9FTMZAQpviomg4OIcLVro7EjfRIz+46uKuAkY=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=U1C9k9Y6RTKIA1GDNZMYlD5qr8OAMBt+yH8tfXPuJS+T7ZbR5LNvhTyoREi8QfXzxNO6MI3BId7aiqWNcqhSou46HSMhAOZD/rZQxtmu+6D1U37Dbyl9tSGVik73jAYpenGVlldgy1/QjfzZpdxAKmLVaIAjyAsgZQAzPtDXBfk=;
X-YMail-OSG: wPf4towVM1kzKMkfG6Gm_gW87dMkgYcR.CvgTvs.IEEAFTl 6j39pZ07fObz8keH5RWZNi_uK6b.jrOqDB7Sv0DPEu3Dku8bLleizgZCbVhu fVKYpfJxMMv2WFeAn3SUVC0VaFlYFbE5NL0LNIQp.HAKoptJMVSqKYz4.0fB C.NhwGwM4gcv8Wbo5MbU9OG8VFofUgRs6o5qxf.s1aLg_CRr50zQhxJXtlf7 J5i1zwHxWmJ0JZNTiyQZD10CUfS.t1VcsFN5TODGe6lqhygjdV4j6gAG1Y6s N3DQEsnmNGnEQKy0rpUx4.GEeWUlojmsV3VowqLaHmKNUfLW43n0s1hjclq2 hNcJwh9eCrf6Y14JRkQcQJUbEmTP71o7XuMi54htZCGatP3E7ML4Kq0qCkhr iXHBMHJ3VhJojheNz5sMZ.KW.cfHxcglIje94UjZU
Received: from [209.131.62.113] by web31816.mail.mud.yahoo.com via HTTP; Wed, 04 Jan 2012 15:42:56 PST
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.116.331537
References: <CALaySJKhYQQdmjvWBLS3mwzzrDt35jfDn2xZCuDOk=hpwEUiKQ@mail.gmail.com> <CAC4RtVDyiuqCGO25nZQEVxi0uchTi2gu_peh=+FwmWwZsQ=LEQ@mail.gmail.com> <CAC4RtVCvnz7n9Ei08h7QRruesJ=GeOMOOvBkNAVmcc8_gzg7QQ@mail.gmail.com> <8AB6F5CC-E9A2-4A07-9AA0-83FB7C67A221@oracle.com> <4EEA3951.5010904@mtcc.com> <OF6C9EBE7C.1B053FE3-ON80257968.003C02DF-80257968.003CAA12@ie.ibm.com> <4EEB5BDD.7080401@mtcc.com> <4F038CB9.1040403@mtcc.com> <F674B8D6-54D6-4B39-A494-9D7EB6E058D6@oracle.com> <4F0394D6.1090006@mtcc.com> <OFD88021B6.E1FD29B9-ON8025797B.004036CF-8025797B.00404EA6@ie.ibm.com> <4F04AAAE.6080702@mtcc.com> <4F04ACE4.1070006@stpeter.im> <4F04B101.3070708@mtcc.com> <OF0587BA9E.B7B40207-ON8025797B.00702BFB-8025797B.007103EA@ie.ibm.com> <CALaySJLcFGyt97OVFZY34kZSjp2bKRqiH_JSDQQaO-aTjSWh2g@mail.gmail.com> <4F04BF70.3010501@mtcc.com>
Message-ID: <1325720576.43079.YahooMailNeo@web31816.mail.mud.yahoo.com>
Date: Wed, 04 Jan 2012 15:42:56 -0800
From: William Mills <wmills@yahoo-inc.com>
To: Michael Thomas <mike@mtcc.com>, Barry Leiba <barryleiba@computer.org>
In-Reply-To: <4F04BF70.3010501@mtcc.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-1238014912-1525551451-1325720576=:43079"
Cc: oauth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] WGLC on draft-ietf-oauth-v2-threatmodel-01, ends 9 Dec 2011
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Jan 2012 23:43:06 -0000

I think the threat draft should simply say, "OAuth does not and can not protect the user against credential compromise as a result of phishing, malware, social engineering, or machine compromise."

Get rid of the fancy rhetoric, we don't need to explain a lot more than this.  


I don't agree that OAuth purports to solve these problems. What it solves is limiting the credentials granted to allow the user more control and limited damage in the event of credential misuse.


-bill



________________________________
 From: Michael Thomas <mike@mtcc.com>
To: Barry Leiba <barryleiba@computer.org> 
Cc: oauth WG <oauth@ietf.org> 
Sent: Wednesday, January 4, 2012 1:06 PM
Subject: Re: [OAUTH-WG] WGLC on draft-ietf-oauth-v2-threatmodel-01, ends 9 Dec 2011
 
On 01/04/2012 12:41 PM, Barry Leiba wrote:
> up being a compromised browser or a native application that the user
> perhaps unwisely installed, all the security in the framework goes out
    ^^^^^^^^^
> the window, because an untrustworthy UA can fiddle with pretty much
> everything.
>

I think the "perhaps unwisely" goes to the heart of my objection. You
might as well be talking about "perhaps unwisely" driving a car,
or "perhaps unwisely" eating food: the reality is that people download
apps by the *billions*.  When I was initially blown off, many of the
participants including document editors implied that only idiots get
apps for their phones. That is *completely* unhelpful as the reality
is that OAUTH's use is hugely if not primarily deployed in that sort of
environment.

This is a threat that cuts to the very heart of what OAUTH is, and purports
to defend against: keeping user credentials out of the hands of an
untrusted third party. If there really aren't any good ways to mitigate this
in an app environment, why is OAUTH being deployed so aggressively there?
Shouldn't the threat draft say in blinking bold: "DEPLOYING OAUTH
IN NATIVE APPS CONSIDERED HARMFUL"?

Mike
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth