Re: [GNAP] Defense protection

Alan,

What does attenuated delegation mean and entail?
I am not finding a definitive definition online.

> On May 29, 2021, at 12:46 AM, Alan Karp <alanhkarp@gmail.com> wrote:
> 
> 
>> On Fri, May 28, 2021 at 1:09 PM Adrian Gropper <agropper@healthurl.com> wrote:
>> Thanks to Alan Karp, I have come to believe that delegation is essential and GNAP needs to speak of capabilities as first-class tokens and encourage their use.  This will become the main driver for adoption of GNAP over SAML or OAuth. 
> 
> I would say attenuated delegation instead of just delegation.  Revocation is important, too.
> 
> --------------
> Alan Karp
> 
> 
>> On Fri, May 28, 2021 at 1:09 PM Adrian Gropper <agropper@healthurl.com> wrote:
>> Thanks to Alan Karp, I have come to believe that delegation is essential and GNAP needs to speak of capabilities as first-class tokens and encourage their use.  This will become the main driver for adoption of GNAP over SAML or OAuth. 
>> 
>> - Adrian
>> 
>> 
>> 
>>> On Fri, May 28, 2021 at 3:51 PM Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
>>> Hi Adrian,
>>> 
>>> Thanks for your interest!
>>> 
>>> This is a helpful link that describes how the attackers were able to bypass MFA by stealing the signing key for SAML assertions:
>>> https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
>>> https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf
>>> 
>>> I did read one that was a bit better, but can't find the link at the moment.
>>> 
>>> And one on shared OAuth credentials/token issuance:
>>> https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html
>>> 
>>> It would be good to think about attack vectors and if not prevention, minimally detection.
>>> 
>>> Best regards,
>>> Kathleen
>>> 
>>>> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <agropper@healthurl.com> wrote:
>>>> Hi Kathleen,
>>>> 
>>>> I am not aware of the attacks on SAML and OAuth and would appreciate a link or two.
>>>> 
>>>> I hope we can provide guidance on how GNAP can facilitate Zero Trust Architecture and believe that includes guidance on how to audit various things as systems use GNAP protocols to separate concerns among independent actors. 
>>>> 
>>>> Count me in for a brainstorming sessio,
>>>> 
>>>> - Adrian
>>>> 
>>>> 
>>>>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
>>>>> Hello!
>>>>> 
>>>>> In light of recent attacks against SAML and OAuth, I'd like to see what defense mechanisms and detection could be built into the spec.  One example would be from the recent SAML attack.  If there was a detection of instances of authorization without authentication, the SAML attack used in SolarWinds might have been detected sooner.
>>>>> 
>>>>> If you think along the lines of fraud detection, where you detect unusual events, there may be some specific to GNAP that could enable early detection of abuse, misuse, or exploits.
>>>>> 
>>>>> Are there some planned?  Would people like to brainstorm on this?
>>>>> Thanks!
>>>>> 
>>>>> 
>>>>> -- 
>>>>> 
>>>>> Best regards,
>>>>> Kathleen
>>>>> -- 
>>>>> TXAuth mailing list
>>>>> TXAuth@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/txauth
>>> 
>>> 
>>> -- 
>>> 
>>> Best regards,
>>> Kathleen
>>> -- 
>>> TXAuth mailing list
>>> TXAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/txauth
> -- 
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth