Re: [OAUTH-WG] The verification URL and CAPTCHA responses for username/password profile?
Peter Saint-Andre <stpeter@stpeter.im> Thu, 11 March 2010 19:00 UTC
Return-Path: <stpeter@stpeter.im>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CD463A6985 for <oauth@core3.amsl.com>; Thu, 11 Mar 2010 11:00:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.568
X-Spam-Level:
X-Spam-Status: No, score=-2.568 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6JvjBpd1TOOU for <oauth@core3.amsl.com>; Thu, 11 Mar 2010 11:00:04 -0800 (PST)
Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 75AD83A6F9B for <oauth@ietf.org>; Thu, 11 Mar 2010 10:34:31 -0800 (PST)
Received: from dhcp-64-101-72-245.cisco.com (dhcp-64-101-72-245.cisco.com [64.101.72.245]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 7496240E14 for <oauth@ietf.org>; Thu, 11 Mar 2010 11:34:36 -0700 (MST)
Message-ID: <4B9937BB.60007@stpeter.im>
Date: Thu, 11 Mar 2010 11:34:35 -0700
From: Peter Saint-Andre <stpeter@stpeter.im>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3
MIME-Version: 1.0
To: oauth@ietf.org
References: <0C7833DF-75CA-4C4D-94A8-C5A20A2F41AB@facebook.com> <3D3C75174CB95F42AD6BCC56E5555B45024ADC56@FIESEXC015.nsn-intra.net>
In-Reply-To: <3D3C75174CB95F42AD6BCC56E5555B45024ADC56@FIESEXC015.nsn-intra.net>
X-Enigmail-Version: 1.0.1
OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="------------ms010205010008010003060305"
Subject: Re: [OAUTH-WG] The verification URL and CAPTCHA responses for username/password profile?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Mar 2010 19:00:05 -0000
<hat type='individual'/> Agreed. On 3/9/10 12:26 AM, Tschofenig, Hannes (NSN - FI/Espoo) wrote: > I agree with your statements below. I would remove the CAPTCHA concept > from the document. > > Ciao > Hannes > >> -----Original Message----- >> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] >> On Behalf Of ext David Recordon >> Sent: 09 March, 2010 06:54 >> To: OAuth WG >> Subject: [OAUTH-WG] The verification URL and CAPTCHA responses >> for username/password profile? >> >> I'm spending some time with the spec this evening and am >> having a hard time understanding the need for the verification >> URL and CAPTCHA responses which are part of the username and >> password profile. >> >> My criteria for using this profile is that 1) the >> authorization server generally trusts the client to >> temporarily collect the end-user's username and password and >> 2) it is impossible to use one of the other authorization >> profiles. This means that the client cannot interact with or >> embed a web browser. Given that... >> >> The client would not be able to send the user to the >> verification URL in the response anyway (otherwise they would >> have picked the rich app profile). If the client were to >> encourage the user to use a nearby computer, then it could use >> the upcoming device API which should be based on the Netflix flow. >> >> The CAPTCHA response verifies that there is a human, not that >> it is the human who the username and password belong to. >> Wouldn't bot attacks be mitigated via aggressive rate limiting >> techniques which reject authorization requests? This response >> seems to be more complex than the benefit and hasn't been >> successfully implemented at scale AFAIK. >> >> --David >> _______________________________________________ >> OAuth mailing list >> OAuth@ietf.org >> https://www.ietf.org/mailman/listinfo/oauth >>
- [OAUTH-WG] The verification URL and CAPTCHA respo… David Recordon
- Re: [OAUTH-WG] The verification URL and CAPTCHA r… Tschofenig, Hannes (NSN - FI/Espoo)
- Re: [OAUTH-WG] The verification URL and CAPTCHA r… Peter Saint-Andre