IETF Logo Mail Archive

[OAUTH-WG] Re: Call for adoption - First Party Apps

Neil Madden <neil.e.madden@gmail.com> Wed, 04 September 2024 14:36 UTC

Return-Path: <neil.e.madden@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E372C14F6F3 for <oauth@ietfa.amsl.com>; Wed, 4 Sep 2024 07:36:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K5X4uIpxX5Ev for <oauth@ietfa.amsl.com>; Wed, 4 Sep 2024 07:36:51 -0700 (PDT)
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FF9BC14F6B8 for <oauth@ietf.org>; Wed, 4 Sep 2024 07:36:51 -0700 (PDT)
Received: by mail-ed1-x530.google.com with SMTP id 4fb4d7f45d1cf-5c26b5f1ea6so1006106a12.0 for <oauth@ietf.org>; Wed, 04 Sep 2024 07:36:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1725460610; x=1726065410; darn=ietf.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=TPYGRh7b0vp/xK9LkTZuuhrcrIDYcG42KmIxZFHuwR4=; b=BfwSq2D6Fa/psz+Jh/IhyZlNfPsLNoWPVjescu3W7dAEocPbJ3l8ORiUzvemOxaBOT D529KuBnFDrrb323ZWAH8RZzdHDdDFabyhJftK3Z7npiDtxmSVJgh8YpjQrIlP8jJjGq WNt+V2vHLZAhlYvMGKzEf/jldvwkOQWv1FLgOogh0nY1RBVLk8R2EUbPPo4qeGWHO1v/ +XePsjNY66+/n5Y1bfGjBWSZqklU8/fPKWHqbJLSQstTKGNcuaE9EAK7rqJ1Keh25RWo nxeaHWo4bFfDNfdDFiib/+nmyYLBZkRnWkd0d8GoQBT0ri4ALfqO00fPgFWohS0ZYHPL ygYA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725460610; x=1726065410; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=TPYGRh7b0vp/xK9LkTZuuhrcrIDYcG42KmIxZFHuwR4=; b=kaYvyGTX4dI/PYiJYNEv/QWWrSsToZ05GWL7MMHXNDGjY4Oee+YDPT+h65VYUaXpqR W7lzZUpyj3M4yuPqADUf9fM9VJPEqtoSS8b0rTpa5iLSSpypiHvvP7XKlmbgmcxmNHfE 5ObpuyBNZxArwe22u+GCSvpVNeE5cNFQyutWapqxj6f05gCRFufgZvTtdUQ4JrmTBQKA 6a7EDpPIVSs/Hn6fVnD6tMi4kiHbF/gmjG8gI7vfPVDRLSqofluBbJSQ8U9RPIsvYxRW asHjpUWo5yE3B76PcJLNnX50DR10+q4A/kf1kBvm0B9zwZM0Kt7aih2Ikeg+QlNHeUFr lf7Q==
X-Gm-Message-State: AOJu0YwncgHEIE17PW9egAOPNSWnHHc4fPZluxJum187LxaQHg+gliLE T8e3e5JCKUgnXtjw69SccOZ3nbRRrYKCBZSL1XrO8MD3NdVczNoL4pQpIA==
X-Google-Smtp-Source: AGHT+IFSGEoI7SpOehVS7w/bzyIDnDtmZ4Q5ZqDyqW3zxPigcnOdqk9njK8gmWX35MOnw6yr+f2KXQ==
X-Received: by 2002:a05:6402:27cf:b0:5c2:695c:5567 with SMTP id 4fb4d7f45d1cf-5c2c28f895fmr1847572a12.7.1725460608677; Wed, 04 Sep 2024 07:36:48 -0700 (PDT)
Received: from smtpclient.apple ([2a00:23ee:2280:3abf:7131:6d9a:79d5:eb98]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5c3cc5689d9sm3072a12.43.2024.09.04.07.36.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Sep 2024 07:36:48 -0700 (PDT)
From: Neil Madden <neil.e.madden@gmail.com>
Message-Id: <33048643-AAAC-4466-B875-72566EBEA7AF@gmail.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_CA0BC922-58ED-4B44-9110-C81CF6C7CD5D"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.10\))
Date: Wed, 04 Sep 2024 15:36:29 +0100
In-Reply-To: <CADNypP9ZHktRzztqCxGfHPOq5A5xo2GohFZms41ZjoTKjkcjkg@mail.gmail.com>
To: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>
References: <CADNypP9ZHktRzztqCxGfHPOq5A5xo2GohFZms41ZjoTKjkcjkg@mail.gmail.com>
X-Mailer: Apple Mail (2.3696.120.41.1.10)
Message-ID-Hash: BZOFPHXME5WXFTG2E23TXMRADG7AQOGC
X-Message-ID-Hash: BZOFPHXME5WXFTG2E23TXMRADG7AQOGC
X-MailFrom: neil.e.madden@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: oauth <oauth@ietf.org>
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [OAUTH-WG] Re: Call for adoption - First Party Apps
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/liBAnhXMDQGsRhtNpGma9hDz0qs>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

I am a bit skeptical about this one. I’m not convinced we should be recommending native UI until/unless we have a really good story around authenticating first-party apps. Without such a story, I don’t think this should be adopted. Unless I’m mistaken, a native UI also rules out WebAuthn/FIDO-based authenticators? We should not be adopting drafts that increase phishing risks for the sake of aesthetics.

— Neil

> On 3 Sep 2024, at 11:46, Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com> wrote:
> 
> All,
> 
> As per the discussion in Vancouver, this is a call for adoption for the First Party Apps draft:
> https://datatracker.ietf.org/doc/draft-parecki-oauth-first-party-apps/ <https://datatracker.ietf.org/doc/draft-parecki-oauth-first-party-apps/>
> 
> Please, reply on the mailing list and let us know if you are in favor or against adopting this draft as WG document, by Sep 17th.
> 
> Regards, 
>  Rifaat & Hannes
> _______________________________________________
> OAuth mailing list -- oauth@ietf.org
> To unsubscribe send an email to oauth-leave@ietf.org

v2.27.6 | Report a Bug | By Email | System Status