Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-security-topics-15.txt

[Denis <[e-mail]>]

Comments on draft-ietf-oauth-security-topics-15

1) Historically, the acronym RO (Resource Owner) has been used but is 
still used in this document.
     Since a client is not necessarily any more a RO, it would be more 
adequate to use the word "Client"
     instead of "RO"  in this document.

2) The structure of the document is the following:

1.Introduction
2.Recommendations
3.The Updated OAuth 2.0 Attacker Model

It is rather odd to have recommendations placed before the Attacker 
Model. Before providing solutions to some problems,
it is important to understand what the problems are. The Updated OAuth 
2.0 Attacker model should be placed after the introduction.

The "most important recommendations of the OAuth working group for every 
OAuth implementor" should be placed after the "Attacks and Mitigations" 
section.

3) The "_Updated _OAuth 2.0 Attacker Model" is supposed to have been 
"updated to account for the potentially _dynamic relationships involving 
multiple parties_".
However, it still misses to address the case of _dynamic relationships 
between clients_, which include scenarios of _collaborative clients_.

Such a collaboration between clients is possible and should be 
considered in the "updated model". Since the Auth 2.0 protocol may be 
used by clients
which are human beings, it cannot be assumed that all the human beings 
in the world will necessary be honest. Whether or not Auth 2.0 is able 
or not
to counter such an attack is another issue.

The collaborative attack should be added to this "updated" model. It was 
missing in the previous model.

In another section, it should be mentioned that OAuth 2.0 is unable to 
counter such an attack.
Stating that such an attack is "out of the scope" of OAuth 2.0 would not 
be an appropriate statement.

It should not be forgotten, that the purpose of this document is to 
inform the reader about _all_ the relevant security issues.

Denis

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Web Authorization Protocol WG of the IETF.
>
>          Title           : OAuth 2.0 Security Best Current Practice
>          Authors         : Torsten Lodderstedt
>                            John Bradley
>                            Andrey Labunets
>                            Daniel Fett
> 	Filename        : draft-ietf-oauth-security-topics-15.txt
> 	Pages           : 46
> 	Date            : 2020-04-05
>
> Abstract:
>     This document describes best current security practice for OAuth 2.0.
>     It updates and extends the OAuth 2.0 Security Threat Model to
>     incorporate practical experiences gathered since OAuth 2.0 was
>     published and covers new threats relevant due to the broader
>     application of OAuth 2.0.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15
> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-15
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-security-topics-15
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth