[OAUTH-WG] Device Flow Open Issues
Hannes Tschofenig <hannes.tschofenig@gmx.net> Fri, 21 October 2016 22:23 UTC
Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5D4312945E for <oauth@ietfa.amsl.com>; Fri, 21 Oct 2016 15:23:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.032
X-Spam-Level:
X-Spam-Status: No, score=-3.032 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rw7VfkaY-L0G for <oauth@ietfa.amsl.com>; Fri, 21 Oct 2016 15:23:10 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0682512943B for <oauth@ietf.org>; Fri, 21 Oct 2016 15:23:09 -0700 (PDT)
Received: from [192.168.91.153] ([104.132.0.103]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0LiY3U-1cVg3S3vum-00cjEJ for <oauth@ietf.org>; Sat, 22 Oct 2016 00:23:07 +0200
To: "oauth@ietf.org" <oauth@ietf.org>
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9
Message-ID: <79bedf7c-05fe-b0e6-d3ba-740530b21b3c@gmx.net>
Date: Sat, 22 Oct 2016 00:23:05 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="b6bdJPqFcAUT9tmmcqFpaUqgRX7cDUFo2"
X-Provags-ID: V03:K0:Ahiani5jCHMoSZpbX6A+Eu4Wc/UUkxOao5AOxfaeR0CfZcwWgMY ru62OE1d6iUu6tD/psqDwj2wETxbzsfsq53R6K0kEdhoAVGlAIirPxjWLLfc10n+0EiTH1u GOvxN6B43dGC9UPSmuq+lviLGOgKPp65m1WzncEXkcYgAD3/40uODiXK4fISoo3S/r4+Z5b m/9r58kR3WS+pWWyGhpJA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:g2mC4vDznxQ=:CSxCbLvRIvRSKdUNX6vUsv XfQ4Ba878fa0iHQ0SkcfnyZeV09CwLuB4Hfa0ZscE4F6bSrMa2bK4aB8Y1x6iloq+WrENPjrS vkkm0mbOZV0YIs45GcwjyvHfePDqGiZQpSE2fHijR0CIt6Y4Wyl99jvCq0PPDfb08uIMeJNNz XRZJBa6NmGm5e20Wfm0ICCFxPolgZcyhH/RvqZ5RQCTb6oSBmkBg8po9d/031zQdmFZaNryT+ f0jeiPUd1GkfhwsrU3tIB6RfYomCxt92nzhXPuPFhOm/nTN5e5+UtKQzbSKQZu8aMGLqT6zRF 5ym7cF4vvQYm7BgtFBmteEXQ1yOagq7pdmfLUBSqWL1H6QpVJ4Riu39VS1oZvBcJPGlfGnsI9 986N8lx9EKxHJhwNTI0REZa/NuDmcqwMi/kRQKv/lwCew/0YXuKLlZGs2xvn6Cfj4LS/qM0nN t+SkPGBkhx9Wl3l7dWcirYRqGhGFxqMDhF1gqoHt/ZB2lPIbjcBI1h+eEeNDsHr+wzPkS5MF8 bKPkadPWbJTIs7amQuaht2vCRxuNv3IzJSEy454kzzyjLKQPbinaxF1/CryG2CSTv6JntMc59 ATENxdHpsE2OJvRKXpAtjzKKHL2BgdyMG7MgpPFKV/p1bRM8okb5e1vEdLmHHoL3KbowfYIgT vEN0eAZnbuk1JRCagwUH32tWFEBoWuRlASBkBNCUJWXUdO9Cq64qezYDJerP1yqNyIdfP1N2Y z/l6afUkPIcM6LqvAuozGjLi/ODBSFG1ZmoPesw/ugTHXh/+Fsh0I/DYx+o=
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/YuVzEDa9B1LUUltfqhu68oRhLao>
Subject: [OAUTH-WG] Device Flow Open Issues
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Oct 2016 22:23:13 -0000
Hi all, at the last IETF meeting we got lots of good feedback regarding the device flow document. Here is the link to the device flow draft: https://tools.ietf.org/html/draft-ietf-oauth-device-flow-03 Four main issues got captured in the minutes, namely 1) Alternative to polling 2) Missing security guidance 3) UI recommendations 4) Alternative Authorization Request/Response Pattern Here is the link to the meeting minutes: https://www.ietf.org/proceedings/96/minutes/minutes-96-oauth In a discussion with John, William, Simon, and myself we thought it would be best to drop a mail to the list about these issues and seek for your feedback. Ciao Hannes
- [OAUTH-WG] Device Flow Open Issues Hannes Tschofenig