Re: [OAUTH-WG] why are we signing?

A possible path for a TLS-challenged site is to simply send tokens in the
clear. This has security implications of course -- though if you're talking
about server to server calls, it's not nearly as bad as browser side cookies
-- but combined with a way to rotate tokens automatically is still a major
improvement over HTTP Basic.

My question is, how large is the set of possible server implementors that
cannot implement TLS, yet still need security better than the clear-tokens
method above?  Can I suggest that if they comprise less than 10% of usage --
however we want to measure that -- then they could dealt with via extensions
rather than core?

(Note also that if someone is just setting up a test service or a fun
startup, they could start without TLS and upgrade without changing their
code at all, which isn't a horribly bad story -- if you want more security,
you can buy it for a nominal fee.  This has worked pretty well for online
merchants.)

--
John Panzer / Google
jpanzer@google.com / abstractioneer.org / @jpanzer

On Mon, Nov 30, 2009 at 12:27 PM, Eran Hammer-Lahav <eran@hueniverse.com>wrote:

> OAuth is being proposed as a generally useful method for securing API
> calls. I expect many open source libraries to implement it on the server
> side and use it for blog plugins, widgets, and other highly distributed
> software. If OAuth required the use of TLS, it would simply be ignored by
> all those applications which will likely continue using Basic.
>
> With all due respect to big companies, their resources, and ability to
> effortlessly deploy SSL/TLS, it is still an expensive and complex process
> for more developers deploying small scale server components.
>
> EHL
>
> > -----Original Message-----
> > From: Tschofenig, Hannes (NSN - FI/Espoo)
> > [mailto:hannes.tschofenig@nsn.com]
> > Sent: Monday, November 30, 2009 11:23 AM
> > To: ext Dick Hardt; Eran Hammer-Lahav
> > Cc: oauth@ietf.org
> > Subject: RE: [OAUTH-WG] why are we signing?
> >
> > I would also like to hear about the cases where TLS is not suitable.
> >
> > Hannes
> >
> > >-----Original Message-----
> > >From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
> > >Of ext Dick Hardt
> > >Sent: 30 November, 2009 21:18
> > >To: Eran Hammer-Lahav
> > >Cc: oauth@ietf.org
> > >Subject: Re: [OAUTH-WG] why are we signing?
> > >
> > >
> > >On 2009-11-13, at 7:21 AM, Eran Hammer-Lahav wrote:
> > >>
> > >> I for one, see great value in offering some form of
> > >crypto-based security for cases where TLS is not suitable.
> > >
> > >
> > >Are these use cases enumerated somewhere?
> > >
> > >(Apologies for coming into the conversation late)
> > >
> > >_______________________________________________
> > >OAuth mailing list
> > >OAuth@ietf.org
> > >https://www.ietf.org/mailman/listinfo/oauth
> > >
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>