Re: [OAUTH-WG] problem statement

[Michael Thomas <[e-mail]>]

On 09/07/2011 05:19 PM, Ben Niven-Jenkins wrote:
> Your original e-mail that started this thread was not targeted at a specific document and my interpretation is that some of the hostility you have experienced is due to a frustration that your request is seen as a potential obstacle to getting the protocol specification out the door because the issue you want to discuss is not directly related to how a developer might implement the protocol.
>    

I had no idea where in the ietf process the protocol document is. I'm
still not sure whether it's been through wg last call, ietf last call, etc.

> If I may be so bold, could I suggest that you propose some text that articulates the issue that you would like to see documented and then the group can assess that text on its merits and try to reach consensus on which document, if any, it is best placed to reside within.
>    

Basically, in the protocol document's introduction I think it should
be clearly explained that the UA functionality is expected to be "trusted",
ie not be under the control of a potential attacker. I think that for the
uninitiated that is anything but obvious. There has been a sea-change
since 2007 making this an important point. Had that been in the
introduction, we would not be having  this conversation.

Mike