Re: [OAUTH-WG] why are we signing?

[Mike Malone <[e-mail]>]

On Tue, Dec 1, 2009 at 6:58 PM, Peter Saint-Andre <[e-mail]> wrote:
> <hat type='individual'/>
>
> On 11/30/09 1:27 PM, Eran Hammer-Lahav wrote:
>> OAuth is being proposed as a generally useful method for securing API
>> calls. I expect many open source libraries to implement it on the
>> server side and use it for blog plugins, widgets, and other highly
>> distributed software. If OAuth required the use of TLS, it would
>> simply be ignored by all those applications which will likely
>> continue using Basic.
>>
>> With all due respect to big companies, their resources, and ability
>> to effortlessly deploy SSL/TLS, it is still an expensive and complex
>> process for more developers deploying small scale server components.
>
> With all due respect, I think it can be harder for big companies to
> deploy TLS -- they have a lot more users, need more hardware (special
> SSL accelerators and the like), have more layers of employees (so it can
> be more difficult to find the person who controls the hostmaster or
> whois-listed email address), etc.
>
> Getting a Class 1 cert from the likes of StartSSL is easy as pie these
> days. IMHO there is no excuse for not deploying SSL if you care one whit
> about security. The problem is that too many small-scale developers (and
> big companies!) simply don't care.

I'm far from an expert on TLS/PKI, but here's a thought (and I'm
pretty sure this has come up before)... If TLS is simpler than
signatures then why not just use PKI for everything. A lot of the
problems that have come up with OAuth are solved by PKI - client certs
replace tokens, you can delegate authority by creating
sub-certificates, the consumer provisioning problem is largely solved,
etc.

It seems like WRAP is using bits of PKI to solve half of the problem
and then re-inventing other bits of PKI for the other half. If TLS/PKI
is the solution, why not go whole hog?

Mike