Re: [OAUTH-WG] I'm concerned about how the sniffability of oauth2 requests

[William Mills <[e-mail]>]

Yes, MAC relies on SSL for transport security.  But you have bigger problems than that if SSL is broken, because your primary authentication credential is compromised now.

Do we need to address sslstrip here if it's a general attack on SSL transport for the browser?


________________________________
 From: Prabath Siriwardena <[e-mail]>
To: William Mills <[e-mail]> 
Cc: L. Preston Sego III <[e-mail]>; "[e-mail]" <[e-mail]> 
Sent: Wednesday, February 6, 2013 8:23 AM
Subject: Re: [OAUTH-WG] I'm concerned about how the sniffability of oauth2 requests
 




On Mon, Feb 4, 2013 at 9:57 PM, William Mills <[e-mail]> wrote:

There are two efforts at signed token types: MAC which is still a possibility if we wake up and do it, and the "Holder Of Key" type tokens.

If someone can use sslstrip then even MAC is not safe - since MAC key needs to be transferred over SSL to the Client from the AS.

There are standard ways in HTTP to avoid or protect from sslstrip - IMHO we need to occupy those best practices...

Thanks & regards,
-Prabath
 

>
>There are a lot of folks that agree with you.
>
>
>
>________________________________
> From: L. Preston Sego III <[e-mail]>
>To: [e-mail] 
>Sent: Friday, February 1, 2013 7:37 AM
>Subject: [OAUTH-WG] I'm concerned about how the sniffability of oauth2 requests
> 
>
>
>In an oauth2 request, the access token is passed along in the header, with nothing else.
>
>
>As I understand it, oauth2 was designed to be simple for everyone to use. And while, that's true, I don't really like how all of the security is reliant on SSL.
>
>
>what if an attack can strip away SSL using a tool such as sslstrip (or whatever else would be more suitable for modern https)? They would be able to see the access token and start forging whatever request he or she wants to.
>
>
>Why not do some sort of RSA-type public-private key thing like back in Oauth1, where there is verification of the payload on each request? Just use a better algorithm?
>_______________________________________________
>OAuth mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>_______________________________________________
>OAuth mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/oauth
>
>


-- 
Thanks & Regards,
Prabath

Mobile : [phone] 

http://blog.facilelogin.com
http://RampartFAQ.com