Re: [OAUTH-WG] why are we signing?

[Eran Hammer-Lahav <[e-mail]>]

And we are always looking for people to write those...

EHL

From: [e-mail] [mailto:[e-mail]] On Behalf Of John Panzer
Sent: Wednesday, December 02, 2009 9:49 AM
To: Prateek Mishra
Cc: [e-mail]
Subject: Re: [OAUTH-WG] why are we signing?

It requires a security considerations section :).
--
John Panzer / Google
[e-mail]<mailto:[e-mail]> / abstractioneer.org<http://abstractioneer.org> / @jpanzer


On Wed, Dec 2, 2009 at 7:18 AM, Prateek Mishra <[e-mail]<mailto:[e-mail]>> wrote:
Stephen,

+1 from our side.

Here is a newbie question: does the IETF process require a discussion of threats and countermeasures
as part of the specification? - explaining the specific situations that rely on SSL or signing and what the consequences
of "turning it off" might be...

- prateek

I think we'll need an analysis of where we end up wanting TLS
for the protocols we produce. I wouldn't expect any big
surprises, but right now I don't think we can be sure since
things seems to be in flux to some extent.

Then, I'd be for saying that TLS MUST be used for those operations.
However, I can well believe that there may be some niches where
using TLS isn't easy, so I could live with something like: it MUST
be possible to use TLS, and that deployments SHOULD use it, with
guidance as to the type of scenario where we think TLS really
has to be turned on, and maybe text about why sometimes people
can't do that.

So I don't think we can finish this discussion at this stage.

S.

Eran Hammer-Lahav wrote:

<smiling but not joking>

I would like to make an official request to the chair for a consensus call on recommending SSL but keeping it optional in the various OAuth components. We can figure out how strong to make the language (or how scary), and we may make it mandatory in some flows/profiles, but I would like to be done with this discussion (for the n time).

If someone will want to raise new arguments, well, this is the IETF so who can stop them? :-)

EHL


-----Original Message-----
From: Dick Hardt [mailto:[e-mail]<mailto:[e-mail]>]
Sent: Tuesday, December 01, 2009 9:51 PM
To: Brian Eaton
Cc: Eran Hammer-Lahav; Peter Saint-Andre; <[e-mail]<mailto:[e-mail]>>;
Tschofenig, Hannes (NSN - FI/Espoo); [e-mail]<mailto:[e-mail]>
Subject: Re: [OAUTH-WG] why are we signing?


On 2009-12-01, at 5:46 PM, Brian Eaton wrote:


On Tue, Dec 1, 2009 at 7:08 PM, Eran Hammer-Lahav

<[e-mail]<mailto:[e-mail]>> wrote:

Getting a Class 1 cert from the likes of StartSSL is easy as pie
these days. IMHO there is no excuse for not deploying SSL if you
care one whit about security. The problem is that too many
small-scale developers (and big companies!) simply don't care.

Don't care, don't need that much security, don't understand it, etc.

Bottom line is that requiring SSL is certain to fork this work if not done right.

Note, however, that someone who can't get SSL working and still
deploys OAuth has basically no security against eavesdroppers or MITM
attacks, and certainly can't expect OAuth to provide it.  The issues
are in the token issuance phase: these organizations are sending user
passwords and session cookies in clear text!  OAuth is the least of
their security concerns,

If the cost of SSL outweighs the risk of a security breach, then why would a
developer deploying OAuth choose to sign their messages rather then use
the simpler bearer token?

Peter Saint-Andre questioned why SSL was required in OAuth WRAP. I think
that is a good question. Perhaps it should be RECOMMENDED, and
deployments can make their own benefit analysis.

-- Dick

_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth


_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth


_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth