Re: [OAUTH-WG] problem statement

[Michael Thomas <[e-mail]>]

On 09/07/2011 12:32 PM, Peter Saint-Andre wrote:
> On 9/7/11 1:24 PM, Michael Thomas wrote:
>    
>> On 09/07/2011 12:12 PM, Eran Hammer-Lahav wrote:
>>
>> [more browbeating elided]
>>
>>      
>>> In fact, you guys have convinced me that OAuth gives inferior
>>> protection at
>>>        
>>>> considerable expense for all concerned.
>>>>
>>>>          
>>> an irresponsible and serious offense - the kind of baseless FUD that
>>> can cause real damage to important work.
>>>
>>>        
>> I have written down at least 3 or 4 times why I think it's inferior.
>> Nobody attacking the messenger including yourself has answered
>> it. There's FUD here, but not from me.
>>      
> Mike, did you propose text to address the concern? Per recent discussion
> I think the threat-model document is the right place for it, so please
> take a look at that spec to see where your proposed text can slot in.
>    
Yes, I outlined what I think should be done at a minimum. I've
also been told by the editor that he won't consider it. Barry
has said that he won't consider it either. Unless the working
group is open to changes, I'm not going to waste my time crafting
the actual changes. So this is your call.

Here's what I wrote previously:

[...]

Second, I'd say that [section 9] is a good first step, but the text there
should be explicit and not pussy-foot around the fact that it
means embedded UA's in phone apps and other examples. It
should also make clear that the "challenge" (ack, ptui) involves
untrusted apps stealing the user's credentials by simply snooping
on the UA itself. If there is reasonable mitigation, then by all means
add text about it. This is important because I do not think that
many people grok the seriousness of the issue, and most especially
people who would deploy oauth authentication services.

Third, I think that the introduction needs to have an applicability
statement of *when/where/what* oauth can be used. That is,
do not beat around the bush about the need for the UA to be
trustable because that is a basic the assumption that oauth makes.
As inconvenient as that may be, it would be far worse for people
in the industry to not fully understand the threat.

Fourth, it would be *really* nice to hear from folks at Facebook
and Twitter who have deployed oauth and oauth-like flows with
their experience here, and most especially if they understood the
threat ahead of their deployment, and what they do to mitigate
it if anything.


Mike