Re: [OAUTH-WG] why are we signing?

[Brian Eaton <[e-mail]>]

On Tue, Dec 1, 2009 at 7:08 PM, Eran Hammer-Lahav <[e-mail]> wrote:
>> Getting a Class 1 cert from the likes of StartSSL is easy as pie these
>> days. IMHO there is no excuse for not deploying SSL if you care one whit
>> about security. The problem is that too many small-scale developers (and
>> big companies!) simply don't care.
>
> Don't care, don't need that much security, don't understand it, etc. Bottom line is that requiring SSL is certain to fork this work if not done right.

Note, however, that someone who can't get SSL working and still
deploys OAuth has basically no security against eavesdroppers or MITM
attacks, and certainly can't expect OAuth to provide it.  The issues
are in the token issuance phase: these organizations are sending user
passwords and session cookies in clear text!  OAuth is the least of
their security concerns,

(Wearing my security geek hat, I think it's pretty reasonable for some
people to refuse to deploy SSL.  It's a business choice.  Security is
about managing risk, and in some cases the cost of getting SSL working
just isn't worth it.  And I'm completely fine with those folks
deploying OAuth without SSL as well.  There's no sense in putting a
bullet proof door on a house made of straw.)

Cheers,
Brian