IETF Logo Mail Archive

Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-threatmodel-07.txt

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 16 August 2012 17:36 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 386B721F85D5 for <oauth@ietfa.amsl.com>; Thu, 16 Aug 2012 10:36:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.203
X-Spam-Level:
X-Spam-Status: No, score=-101.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VN9jsuAB8mTY for <oauth@ietfa.amsl.com>; Thu, 16 Aug 2012 10:36:32 -0700 (PDT)
Received: from scss.tcd.ie (hermes.scss.tcd.ie [IPv6:2001:770:10:200:889f:cdff:fe8d:ccd2]) by ietfa.amsl.com (Postfix) with ESMTP id 82CEF21F85D2 for <oauth@ietf.org>; Thu, 16 Aug 2012 10:36:31 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by hermes.scss.tcd.ie (Postfix) with ESMTP id 01196171490; Thu, 16 Aug 2012 18:36:30 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; h=date :subject:from:x-mailer:message-id:content-type :content-transfer-encoding:mime-version:in-reply-to:references :received:received:x-virus-scanned; s=cs; t=1345138588; bh=asRTs XPbIqyXwPSvhFUkVMOITF4QCVlCRRQhW7AhMeU=; b=W6G5Bp/w/ZxlFWnw3FMHI GDUk//A99T9jKEb69q2HBnYJBZzQ3w9DeKjjXW1B0/QYRk3uUPGcyQFraKFQAyi4 /cmncT5cRiGjnx4fu3UXnhsJMIR5AwKfbdigIAOarsNPOMfi7WduoDN8GCo/Jkbs 5QEspkVTprNUrP650X7YFE+mAzj7g/RwESj7IDNYmq5wpX/CLiKVsmH3DRmx+UYs JgnMJJZjeutYXbs+u/z84HHDoYVEsOfQ/JFvxpUpdeyqDyane6VV2mO1OQT+/ebY xgS0BCWsEBbDlw+PhJL0/x/HJW+tliX3iVnS2alrFSP2LXapWsAQ9qTcvZZS8QAy w==
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from scss.tcd.ie ([127.0.0.1]) by localhost (scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10027) with ESMTP id h8PvZik3k9HD; Thu, 16 Aug 2012 18:36:28 +0100 (IST)
Received: from [10.87.48.3] (unknown [86.45.61.162]) by smtp.scss.tcd.ie (Postfix) with ESMTPSA id 5373E17148F; Thu, 16 Aug 2012 18:36:27 +0100 (IST)
References: <20120816171445.29317.99704.idtracker@ietfa.amsl.com> <502D2BA4.9010305@lodderstedt.net>
In-Reply-To: <502D2BA4.9010305@lodderstedt.net>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="us-ascii"
Message-Id: <6D4DA1C9-B84C-4075-AF94-AB960344D645@cs.tcd.ie>
X-Mailer: iPhone Mail (9B206)
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Date: Thu, 16 Aug 2012 18:35:58 +0100
To: Torsten Lodderstedt <torsten@lodderstedt.net>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-threatmodel-07.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Aug 2012 17:36:33 -0000

Thanks,

Since this is on the Aug 30 telechat let's  not have any further changes without a chair/AD asking.

Ta,
S

On 16 Aug 2012, at 18:19, Torsten Lodderstedt <torsten@lodderstedt.net> wrote:

> Hi all,
> 
> the new revision covers token substitution, which has been added to the core spec lately. Additionally, it describes a similar attack on the code flow, which is prevented by forcing the authorization server to validate that an authorization code had been issued to the calling client.
> 
> We also made the references to core and bearer spec normative.
> 
> regards,
> Torsten.
> 
> Am 16.08.2012 19:14, schrieb internet-drafts@ietf.org:
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>  This draft is a work item of the Web Authorization Protocol Working Group of the IETF.
>> 
>>    Title           : OAuth 2.0 Threat Model and Security Considerations
>>    Author(s)       : Torsten Lodderstedt
>>                           Mark McGloin
>>                           Phil Hunt
>>    Filename        : draft-ietf-oauth-v2-threatmodel-07.txt
>>    Pages           : 70
>>    Date            : 2012-08-16
>> 
>> Abstract:
>>    This document gives additional security considerations for OAuth,
>>    beyond those in the OAuth specification, based on a comprehensive
>>    threat model for the OAuth 2.0 Protocol.
>> 
>> 
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-threatmodel
>> 
>> There's also a htmlized version available at:
>> http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-07
>> 
>> A diff from the previous version is available at:
>> http://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-v2-threatmodel-07
>> 
>> 
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email