IETF Logo Mail Archive

Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations

Mike Jones <Michael.Jones@microsoft.com> Wed, 09 January 2013 21:52 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5A4821F86F8 for <oauth@ietfa.amsl.com>; Wed, 9 Jan 2013 13:52:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8JT6GC-sRWNd for <oauth@ietfa.amsl.com>; Wed, 9 Jan 2013 13:52:28 -0800 (PST)
Received: from NA01-BL2-obe.outbound.protection.outlook.com (na01-bl2-obe.ptr.protection.outlook.com [65.55.169.32]) by ietfa.amsl.com (Postfix) with ESMTP id CECE921F86F7 for <oauth@ietf.org>; Wed, 9 Jan 2013 13:52:27 -0800 (PST)
Received: from BL2FFO11FD011.protection.gbl (10.173.161.204) by BL2FFO11HUB032.protection.gbl (10.173.161.56) with Microsoft SMTP Server (TLS) id 15.0.596.13; Wed, 9 Jan 2013 21:52:25 +0000
Received: from TK5EX14HUBC107.redmond.corp.microsoft.com (131.107.125.37) by BL2FFO11FD011.mail.protection.outlook.com (10.173.161.17) with Microsoft SMTP Server (TLS) id 15.0.596.13 via Frontend Transport; Wed, 9 Jan 2013 21:52:25 +0000
Received: from TK5EX14MBXC283.redmond.corp.microsoft.com ([169.254.2.24]) by TK5EX14HUBC107.redmond.corp.microsoft.com ([157.54.80.67]) with mapi id 14.02.0318.003; Wed, 9 Jan 2013 21:51:43 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>, Phil Hunt <phil.hunt@oracle.com>, "Mark Mcgloin (mark.mcgloin@ie.ibm.com)" <mark.mcgloin@ie.ibm.com>
Thread-Topic: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations
Thread-Index: AQHN7SETWewWaSWp20yagcTYYxPqVphBi/xA
Date: Wed, 09 Jan 2013 21:51:42 +0000
Message-ID: <4E1F6AAD24975D4BA5B168042967394366A097E6@TK5EX14MBXC283.redmond.corp.microsoft.com>
References: <20130107214016.94851B1E007@rfc-editor.org>
In-Reply-To: <20130107214016.94851B1E007@rfc-editor.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.74]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Forefront-Antispam-Report: CIP:131.107.125.37; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(13464002)(377454001)(56776001)(74662001)(46406002)(5343655001)(5343635001)(79102001)(23726001)(74502001)(53806001)(16406001)(4396001)(54316002)(33656001)(54356001)(44976002)(47776002)(50986001)(50466001)(49866001)(51856001)(76482001)(47976001)(47446002)(31966008)(47736001)(15202345001)(77982001)(56816002)(46102001)(550184003)(55846006)(59766001); DIR:OUT; SFP:; SCL:1; SRVR:BL2FFO11HUB032; H:TK5EX14HUBC107.redmond.corp.microsoft.com; LANG:en;
X-OriginatorOrg: microsoft.onmicrosoft.com
X-Forefront-PRVS: 07215D0470
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Jan 2013 21:52:28 -0000

Congratulations on this achievement, guys!

				-- Mike

-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of rfc-editor@rfc-editor.org
Sent: Monday, January 07, 2013 1:40 PM
To: ietf-announce@ietf.org; rfc-dist@rfc-editor.org
Cc: oauth@ietf.org; rfc-editor@rfc-editor.org
Subject: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations


A new Request for Comments is now available in online RFC libraries.

        
        RFC 6819

        Title:      OAuth 2.0 Threat Model and 
                    Security Considerations 
        Author:     T. Lodderstedt, Ed.,
                    M. McGloin, 
                    P. Hunt
        Status:     Informational
        Stream:     IETF
        Date:       January 2013
        Mailbox:    torsten@lodderstedt.net, 
                    mark.mcgloin@ie.ibm.com, 
                    phil.hunt@yahoo.com
        Pages:      71
        Characters: 158332
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-oauth-v2-threatmodel-08.txt

        URL:        http://www.rfc-editor.org/rfc/rfc6819.txt

This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the OAuth 2.0 protocol.  This document is not an Internet Standards Track specification; it is published for informational purposes.

This document is a product of the Web Authorization Protocol Working Group of the IETF.


INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution.


The RFC Editor Team
Association Management Solutions, LLC


_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email