Re: [OAUTH-WG] Device Profile

[Brent Goldman <[e-mail]>]

I wasn't aware of RFC 5724; using URLs to represent SMS numbers is pretty sweet. It sounds like we should be able to work that into the spec.

Text messages reminded me of another way for the user to communicate the verification code to the AS -- mobile apps. E.g., if the user initiates a link on their Roku device to Netflix, then instead of loading up netflix.com/roku (or whatever the URL is) to enter the code, they can just load up the Netflix iPhone app. I don't think this can be represented with URLs, but perhaps can be expressed if there was a text field in the response to be displayed to the user (e.g., "Use the Netflix iPhone app instead!").

-Brent

On Mar 17, 2010, at 1:44 PM, Shafi, Saleem wrote:

>> Authenticating the user via text message is an awesome idea, but we can't really communicate that to the device as another
>> oauth_verification_url. This is probably worthy of another profile. Using SMS to auth could also be useful at an untrusted
>> computer at an internet cafe -- maybe you don't want to authenticate yourself with the AS via password in case a keylogger
>> is installed. 
> 
> I'm not sure I understand why we couldn't use the oauth_verification_url for this..  Following RFC 5724 (http://tools.ietf.org/html/rfc5724), couldn't we have something like this:
> 
>    HTTP/1.1 200 OK
>    Content-Type: application/x-www-form-urlencoded
> 
>    oauth_device_code=74tq5miHKB&oauth_user_code=94248&oauth_verification_url=http%3A%2F%2Fwww%2Eexample%2Ecom%2Fdevice&oauth_verification_url=sms%3A%2B180080080000
> 
> Then the client could display the option to the user to either visit http://www.example.com/device or send an SMS to 1-800-800-8000
> 
>> I'm not sure I like the reverse of this scenario. What stops other people from entering my identifier into their device,
>> thus causing the AS to ping me via email or SMS? Also, the Device Profile was created as the reverse of OAuth, so the reverse
>> of the Device Profile is just a variation on regular OAuth! Maybe this could be developed into yet another profile.
> 
> You're right, spam could be a problem, but it would be a user annoyance issue that could be mitigated by the Authorization Server much like any other spam filter might..  E.g., users could opt-out/opt-in to the entire process, or allow only certain devices/clients to communicate with them, etc..  In any case, I don't think it would pose a security risk since I simply wouldn't enter the code I received into the device if I wasn't the one that initiated it and am probably not physically at the device anyway..
> 
> Perhaps it doesn't make sense to lump this in with the device profile you've defined since the process is different enough, but I think the use cases overlap..  The only difference really is that in your flow, the user code travels from the AS to the client to the user and back to the AS; whereas in the flow I've described, it flows from the AS to the user to the client back to the AS..  Which direction the code travels depends on what kind of input options are available and the relationship between the AS and user..
> 
> 
> Saleem.
> 
> 
> -----Original Message-----
> From: Brent Goldman [mailto:[e-mail]] 
> Sent: Wednesday, March 17, 2010 6:43 AM
> To: Shafi, Saleem
> Cc: OAuth WG ([e-mail])
> Subject: Re: Device Profile
> 
> On Mar 16, 2010, at 12:19 PM, Shafi, Saleem wrote:
> 
>> Is there any interest in being able to respond with multiple oauth_verification_url values?  I can forsee the possibility of the Authorization Server being able to support browser-based user verification (http/https) or text messages (assuming we could authenticate the user on sending the SMS)..  Letting the authorization server return multiple URLs could give the client/user more options..
> 
> Authenticating the user via text message is an awesome idea, but we can't really communicate that to the device as another oauth_verification_url. This is probably worthy of another profile. Using SMS to auth could also be useful at an untrusted computer at an internet cafe -- maybe you don't want to authenticate yourself with the AS via password in case a keylogger is installed.
> 
>> Also, would there be room in this profile for a scenario where the user verification code isn't returned to the client, but rather sent to the user directly?  If the initial request that the client makes includes some identifier for the user and the authorization server has contact information for that user, could the AS inform the user (via email, sms, IVR, etc) of a one-time user code that they would enter into the device*?  It's sort of the reverse model, but it should still establish a connection between the device, AS and user..  This profile might make sense where the device has very simple data entry options and the user might not be near a browser-capable device..
> 
> I'm not sure I like the reverse of this scenario. What stops other people from entering my identifier into their device, thus causing the AS to ping me via email or SMS? Also, the Device Profile was created as the reverse of OAuth, so the reverse of the Device Profile is just a variation on regular OAuth! Maybe this could be developed into yet another profile.
> 
> -Brent
> 
> 
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On Behalf 
>> Of Brent Goldman
>> Sent: Thursday, March 11, 2010 4:28 AM
>> To: OAuth WG ([e-mail])
>> Subject: [OAUTH-WG] Device Profile
>> 
>> Over the past couple days, Luke Shepard, David Recordon, and I have been brainstorming an OAuth profile for standardizing the flow that devices such as game consoles and entertainment centers use to hook up with services such as Netflix and iTunes. The basic flow is that a device can gain authorization by directing the user to visit a URL on their computer and to enter a verification code copied from the device's screen.
>> 
>> A draft spec is attached to this email. Any thoughts or feedback?
>> 
>> Note: this is one of the many profiles going into the OAuth 2.0 draft that David is writing (http://daveman692.livejournal.com/349384.html).
>> 
>> -Brent
>> 
>> 
>