Re: [OAUTH-WG] problem statement

[John Kemp <[e-mail]>]

On Sep 6, 2011, at 3:49 PM, Michael Thomas wrote:
> 
> Except in the desktop web world, I choose from a *tiny* set of browsers:
> chrome, firefox, opera, and, uh, ie. To a lesser or greater extent, I don't
> expect that the browsers themselves are malicious. Which is a pretty ok
> assumption.

It is? I would certainly question it. The WebKit WebView is embeddable in the C/C++ programming languages and APIs are available for that on most platforms - all are open to the same attacks you mention. How about the plugins you get for your browser from various places - they could have key loggers too. It's also possible for an app delivered from a server to present a login form that looks like it is from Twitter, but is actually from an attacker site. Such attacks are very common indeed, and don't require a key logger. They do require the user to "trust" the app though, just as the user would need to trust the key logger he installed.

> 
> With embedded web views, that assumption goes out the window. There are
> 100's of thousands of apps, all of which can use webviews. I have no way
> to know if a given app is evil or not, and *lots* of apps provide facebook
> and twitter integration. Not because they're evil, but because that's what's
> expected by users. So the use model of oauth in this case is *very* different
> than the desktop use case.

I disagree. If anything, because desktop machines tend to be less 'locked-down' than mobile platforms (app stores for desktops followed app stores for mobile platforms), they are more widely open to abuse.

> 
> But I'm being told that use cases aren't the problem of oauth. I'd say that
> there has all along been a hidden assumption that the browser was
> a trusted entity.

The point is simply that if you can subvert the actual platform, then OAuth problems are the least of your worries (as a user).

- John

> Since it isn't always, it should be very explicit in the
> protocol, threats, and security considerations of what could happen if it's
> not.
> 
> Mike, frankly this is why apps do suck but i'm not king of the world
> 
>> -- Justin
>> On Tue, 2011-09-06 at 15:28 -0400, Michael Thomas wrote:
>>> Melinda Shore wrote:
>>>> On 09/06/2011 11:11 AM, Jill Burrows wrote:
>>>>> I repeat, it is not an OAuth problem.
>>>> If I'm reading Mike correctly (and if I'm not it won't be the
>>>> first time I've misunderstood him), he's not really asking for
>>>> OAUTH to solve this particular problem but to clarify the
>>>> documents and beef up discussions of what is and is not in
>>>> scope.  He read the document and couldn't figure out whether
>>>> or not this particular problem is the business of the working
>>>> group.
>>> I'm fairly certain that if somebody were deploying oauth for their servers
>>> that unless the document told me that oauth doesn't provide protection
>>> against third party snooping if it's embedded in any app, most people wouldn't
>>> have a clue that that was a dangerous assumption.
>>> 
>>> What this says is that oauth only works in one use case, and that only the
>>> user can tell the difference. Given the proliferation of phone apps and
>>> embedded webviews, it seems that the original assumptions of oauth are
>>> no longer up to date.
>>> 
>>> Mike
>>> _______________________________________________
>>> OAuth mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/oauth
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth