Re: [OAUTH-WG] Auth Code Swap Attack

[Eran Hammer-Lahav <[e-mail]>]

Please go back to the beginning of the thread where I expressed (not as editor) my "significant objection" and listed actual problems with the proposed text, as well as the entire justification for making it.

In addition, my text is well within my discretion for making non-normative editorial changes.

EHL

> -----Original Message-----
> From: [e-mail]
> [mailto:[e-mail]] On Behalf Of Barry Leiba
> Sent: Monday, August 15, 2011 8:07 AM
> To: Anthony Nadalin
> Cc: Eran Hammer-Lahav; [e-mail]; Torsten Lodderstedt; OAuth WG
> ([e-mail])
> Subject: Re: [OAUTH-WG] Auth Code Swap Attack
> 
> On Mon, Aug 15, 2011 at 10:51 AM, Anthony Nadalin
> <[e-mail]> wrote:
> > That's nice, four people come up with text and you decide to use your text.
> > Making state optional does nothing to fix the protocol issue, people
> > will get this wrong and have. Our developers have been through this
> > and agreed upon the text that was generated. They find the text in the
> > current draft unacceptable and confusing and think that new text is
> acceptable.
> 
> I have to agree with what Tony says above.  The text proposed in his
> message was agreed upon by several WG participants, and unless there's
> some significant objection to it I think we should use it in the -21 version,
> subject to final WG review.
> 
> Barry, as chair