From nobody Fri May 28 12:29:26 2021 Return-Path: X-Original-To: txauth@ietfa.amsl.com Delivered-To: txauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E70C3A32E6 for ; Fri, 28 May 2021 12:29:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Se08nZcKQOVR for ; Fri, 28 May 2021 12:29:23 -0700 (PDT) Received: from mail-vs1-xe34.google.com (mail-vs1-xe34.google.com [IPv6:2607:f8b0:4864:20::e34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC13E3A32E5 for ; Fri, 28 May 2021 12:29:23 -0700 (PDT) Received: by mail-vs1-xe34.google.com with SMTP id f11so2750629vst.0 for ; Fri, 28 May 2021 12:29:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=IkX/FlUPeBP/XbMTTfTi/Bm051WeeIQZKSPcz72rvhQ=; b=ZUACPYMWmLpa8dnpToF/Fhs8pRRV6xMPLqil/ViJYXWpVTaUr4bJouPR7xFQQFni/M L6T/ritBO1P3KcPdbuoAQbIoGxLnrzptw5DoV/md41z5gLTMO8lwiDqP12wXuSg3Ea/b Q16VQ21VVD4TX4dAGjUbmGrUAG1ecY/xCmuhWpgXURmEPVn7COE+3I8ODBf6eCz2/7I/ zBt/X1GVaprk1i6m6Vv2Vo9ff02UORhrL97tMILiquGSAZGI3Q0DtzPWw8odO/566VzW g5afHILBXyMVTf/fdYbGQSKE4MNrnLbsnwuQePN745dxB+DywIuqsC0X9PcrgNQQutw9 /+mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=IkX/FlUPeBP/XbMTTfTi/Bm051WeeIQZKSPcz72rvhQ=; b=ZRekK2dkc0huMNDVntwz8BOPiesDdjtW1dWHiCTDl1Fa/Z/lnrumSojzkeeY9L4EG5 wUoQU0zC5T2KHoZXm8INnX0yentTdJErWmFJZCMfFKNetvYZUrxN738xV/hAHOqZAl2d NRvVQzJ1i4RgCHkKCr1M/kD1uaPNN/3bJz72V/5SF/+Hxz+H/6UIKTrm+O1TSs+qKTy+ an2fCN29VrbHcixokpnfW7t/+kuzkA0fIYd9QfGB8RatOsOqO3j/YB454r80dVGvPeim iq5PMSdVmlNlwoT08W6SvTelHmLFogplycpzBFNNi8c6UgcL+5PEePhHbftiE4T5ct4i XiLQ== X-Gm-Message-State: AOAM531Ds90wQcwLD81MO/34JBaW9jkMmpJnq3Rca7CyLFuHPMdWrtD9 g6MHfY7RpFPpEk+Nec6sA0ZZQpafYIk+Onq165+PBokSdsg= X-Google-Smtp-Source: ABdhPJw6beksx9tsBVwuwD+3PmhtNId8uwB79Al52ASgU7QmZeSY44hyEkB76skzEdebAMPYQ5aTVrYv6LihZ2bH1Ck= X-Received: by 2002:a67:b709:: with SMTP id h9mr8881372vsf.39.1622230160675; Fri, 28 May 2021 12:29:20 -0700 (PDT) MIME-Version: 1.0 From: Kathleen Moriarty Date: Fri, 28 May 2021 15:28:44 -0400 Message-ID: To: GNAP Mailing List Content-Type: multipart/alternative; boundary="00000000000078974005c368e4a9" Archived-At: Subject: [GNAP] Defense protection X-BeenThere: txauth@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: GNAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 May 2021 19:29:25 -0000 --00000000000078974005c368e4a9 Content-Type: text/plain; charset="UTF-8" Hello! In light of recent attacks against SAML and OAuth, I'd like to see what defense mechanisms and detection could be built into the spec. One example would be from the recent SAML attack. If there was a detection of instances of authorization without authentication, the SAML attack used in SolarWinds might have been detected sooner. If you think along the lines of fraud detection, where you detect unusual events, there may be some specific to GNAP that could enable early detection of abuse, misuse, or exploits. Are there some planned? Would people like to brainstorm on this? Thanks! -- Best regards, Kathleen --00000000000078974005c368e4a9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello!

In light of recent attacks again= st SAML and OAuth, I'd like to see what defense mechanisms and detectio= n could be built into the spec.=C2=A0 One example would be from the recent = SAML attack.=C2=A0 If there was a detection of instances of authorization w= ithout authentication, the SAML attack used in SolarWinds might have been d= etected sooner.

If you think along the lines of fr= aud detection, where you detect unusual events, there may be some specific = to GNAP that could enable early detection of abuse, misuse, or exploits.

Are there some planned?=C2=A0 Would people like to b= rainstorm on this?
Thanks!

--

Best regards,
Kathleen
<= /div>
--00000000000078974005c368e4a9--