This text has been proposed by 2 WG members (Niv and me), and reviewed by 3 others
(Phil, Tony,>Barry) and all agree with it.
Maybe my e-mail was lost, but I was and still am among those who have agreed
with the text, as I am sure many others have
What is also important is that no one has objected.
I see neither the reason nor the right of an editor to remove the text.
Igor
On 8/18/2011 3:51 AM, Lodderstedt, Torsten wrote:
I've read the thread leading to this, and the proposed text and I do not
understand the attack. Can you>provide a step-by-step scenario of how an
attacker gains access?
I'm honestly surprised you do not understand the attack. The client simply uses screen
scraping on the authorization flow and programmatically "presses" the right
buttons. This obviously only works if the client can predict the form structure and
expected input values.
Also, it is unlikely that any major provider is going to require CAPCHA as part of
the authorization flow.>This is especially true in the case of using OAuth for
login which has to be practically transparent (one>click). I would hate to
recommend a solution that no one is going to take seriously.
This text has been proposed by 2 WG members (Niv and me), and reviewed by 3
others (Phil, Tony, Barry) and all agree with it. What is the foundation of
your strong assessment?
The text proposes three classes of countermeasures (detect source, prevent
using unpredictable input, inform resource owner and give her a chance to
revoke). CAPTCHAs are one out of three examples given for unpredictable input.
So I don't understand why your objection focuses on it. The selection of the
appropriate countermeasure is the task of the service provider and it will most
likely depend this on its capabilities, cost, user experience, and risk/impact
associated with abuse. CAPTCHAs (and even one time passwords) might not be the
choice for the average internet service. This will be completely different if
OAuth is used to process payment transactions.
I'm keeping this proposed text out until we resolve this questions.
See above - I probably misunderstand the IETF process, but several people
agreed with it and no one (except you) objected. Why do you hold it back?
regards,
Torsten.
EHL
-----Original Message-----
From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf
Of Torsten Lodderstedt
Sent: Friday, August 12, 2011 7:56 AM
To: oauth@ietf.org
Subject: [OAUTH-WG] Draft 20 last call comment (Resource Owner
Impersonation)
Hi all,
I think the impersonation issue as raised by Niv on the list should be covered
by the core spec. It directly aims at the trustworthiness of the user consent,
which in my opinion is one of the core principles of OAuth. I therefore
suggest to add a description to section 10.
Please find below the text Niv and I prepared. In comparison to Niv's original
proposal, it covers resource owner impersonation for all client categories.
regards,
Torsten.
proposed text:
10.<to be determined> Resource Owner Impersonation
When a client requests access to protected resources, the authorization flow
normally involves the resource owner's explicit response to the access
request, either granting or denying access to the protected resources.
A malicious client can exploit knowledge of the structure of this flow in order
to gain authorization without the resource owner's consent, by transmitting
the necessary requests programmatically, and simulating the flow against the
authorization server. An suthorization server will be vulnerable to this threat,
if it uses non-interactive authentication mechanisms or split the authorization
flow across multiple pages.
It is RECOMMENDED that the authorization server takes measures to ensure
that the authorization flow cannot be simulated.
Attacks performed by scripts running within a trusted user-agent can be
detected by verifying the source of the request using HTTP referrer headers.
In order to prevent such an attack, the authorization server may force a user
interaction based on non-predictable input values as part of the user consent
approval.
The authorization server could combine password authentication and user
consent in a single form, make use of CAPTCHAs or one-time secrets.
Alternatively, the authorization server could notify the resource owner of
any approval by appropriate means, e.g. text message or e-Mail.
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
