Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-device-flow-13.txt

[George Fletcher <[e-mail]>]

Have we considered replacing the device_code logic with PKCE now that 
PKCE exists? At the time we started this spec I'm not sure PKCE was 
around, but now that it exists and is required (practically speaking) 
for mobile apps, should we look at using it instead of device_code to 
protect this flow?

I'm assuming that most of these devices can not protect secrets and 
hence are effectively "public" clients.

If this has already been considered and I missed it, I'm sorry for the 
noise :)

Thanks,
George

On 10/19/18 5:14 PM, [e-mail] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Web Authorization Protocol WG of the IETF.
>
>          Title           : OAuth 2.0 Device Flow for Browserless and Input Constrained Devices
>          Authors         : William Denniss
>                            John Bradley
>                            Michael B. Jones
>                            Hannes Tschofenig
> 	Filename        : draft-ietf-oauth-device-flow-13.txt
> 	Pages           : 21
> 	Date            : 2018-10-19
>
> Abstract:
>     This OAuth 2.0 authorization flow is designed for devices that either
>     lack a browser to perform a user-agent based OAuth flow, or are
>     input-constrained to the extent that requiring the user to input a
>     lot of text (like their credentials to authenticate with the
>     authorization server) is impractical.  It enables OAuth clients on
>     such devices (like smart TVs, media consoles, digital picture frames,
>     and printers) to obtain user authorization to access protected
>     resources without using an on-device user-agent, provided that they
>     have an Internet connection.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-oauth-device-flow-13
> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-device-flow-13
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-device-flow-13
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>