Thanks Bjorn, I have opened an issue and the fix will be in the next update. Much appreciated!
From: Hjelm, Bjorn <bjorn.hj...@verizonwireless.com> Sent: Thursday, October 27, 2022 4:25 AM To: Pieter Kasselman <pieter.kassel...@microsoft.com>; Daniel Fett <dani...@yes.com>; Filip Skokan <filip.sko...@okta.com> Cc: oauth@ietf.org; Joseph Heenan <jos...@authlete.com> Subject: Re: [E] Re: [OAUTH-WG] Draft Proposal for a Cross Device Flow Security BCP You don't often get email from bjorn.hj...@verizonwireless.com<mailto:bjorn.hj...@verizonwireless.com>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> As an editorial note, the text referenced (section 5.2.4) by Joseph, "If FIDO2/WebAuthn support is not available, Channel Initiated Backchannel Authentication (CIBA) provides an alternative.." should reference "Client Initiated Backchannel Authentication (CIBA)". This reference is correct in the other sections of the document. BR, Bjorn On Tue, Oct 25, 2022 at 3:49 AM Joseph Heenan <jos...@authlete.com<mailto:jos...@authlete.com>> wrote: Hi Pieter / Daniel / Filip It's great to see this document moving forward. I may have missed it, but it may be worth being move explicit that one solution is to avoid using cross-device flows for same-device scenarios? It's sort of obvious, but questions like "well CIBA works for both cross-device and same-device, can't I save myself effort by only implementing CIBA and not bothering with standard redirect-based OAuth flows?" are commonly asked. Also, in this text: "If FIDO2/WebAuthn support is not available, Channel Initiated Backchannel Authentication (CIBA) provides an alternative, provided that the underlying devices can receive push notifications." It might be best to use a term other than 'push notifications' there or otherwise rewording this, as there are alternatives. e.g. I think there's at least one CIBA implementation out there that can use email to notify the user of an authorization request. Thanks Joseph > On 19 Oct 2022, at 15:55, Pieter Kasselman > <pieter.kasselman=40microsoft....@dmarc.ietf.org<mailto:40microsoft....@dmarc.ietf.org>> > wrote: > > Hi All > > Following on from the discussions at IETF 113, the OAuth Security Workshop, > Identiverse and IETF 114, Daniel, Filip and I created a draft document > capturing some of the attacks that we are seeing on cross device flows, > including Device Authorization Grant (aka Device Code Flow). > > These attacks exploit the unauthenticated channel between devices to trick > users into granting authorization by using social engineering techniques to > change the context in which authorization is requested. > > The purpose of the document is to serve as guidance on best practices when > designing and implementing scenarios that require cross device flows. We > would appreciate any feedback or comments on the document, or any other > mitigations or techniques that can be used to mitigate these attacks. Links > to the documents are below. We also hope to discuss this at IETF 115 in > London in a few weeks' time. > > ----------------------------------------------------------------------------------------------------- > A new version of I-D, draft-kasselman-cross-device-security-00.txt > has been successfully submitted by Pieter Kasselman and posted to the IETF > repository. > > Name: draft-kasselman-cross-device-security > Revision: 00 > Title: Cross Device Flows: Security Best Current Practice > Document date: 2022-10-19 > Group: Individual Submission > Pages: 25 > URL: > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.txt&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=xGpRQKj7UudEOCRHx2eWl0xhVQ1D5i4SH8sehvDPpCY&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.txt%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DxGpRQKj7UudEOCRHx2eWl0xhVQ1D5i4SH8sehvDPpCY%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=TSMcP7Ix0dtwH9BgsKwvoqqfDdMdzGMF%2BkER4dp8Hd0%3D&reserved=0> > Status: > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.txt&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=xGpRQKj7UudEOCRHx2eWl0xhVQ1D5i4SH8sehvDPpCY&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.txt%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DxGpRQKj7UudEOCRHx2eWl0xhVQ1D5i4SH8sehvDPpCY%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=TSMcP7Ix0dtwH9BgsKwvoqqfDdMdzGMF%2BkER4dp8Hd0%3D&reserved=0> > Html: > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.html&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=Sn0l7u31WG8K0mcGdKvUMraqQsXlGLzj_Ek6bm_qMBs&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__www.ietf.org_archive_id_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity-2D00.html%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DSn0l7u31WG8K0mcGdKvUMraqQsXlGLzj_Ek6bm_qMBs%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=kpRGaKL%2FOvFXkeiCyjQfUxAPpgEVK7asXYqEJbn0m2E%3D&reserved=0> > Htmlized: > https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=TIQiF6Tn_sL0gchPWuET0N1NzdX4NNU_br6SWEoc_fc&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__datatracker.ietf.org_doc_html_draft-2Dkasselman-2Dcross-2Ddevice-2Dsecurity%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DTIQiF6Tn_sL0gchPWuET0N1NzdX4NNU_br6SWEoc_fc%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=V%2F6KhwQWHrNQIRxNy%2B24C1igffty%2FlVFr0bE4mwz1oE%3D&reserved=0> > > > Abstract: > This document describes threats against cross-device flows along with > near term mitigations, protocol selection guidance and the analytical > tools needed to evaluate the effectiveness of these mitigations. It > serves as a security guide to system designers, architects, product > managers, security specialists, fraud analysts and engineers > implementing cross-device flows. > > > > > The IETF Secretariat > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org<mailto:OAuth@ietf.org> > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=DSum4-_qXZwEKnhYE43SP8fE_YzNpYlGTBUPzJCz8Ok&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__www.ietf.org_mailman_listinfo_oauth%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DDSum4-_qXZwEKnhYE43SP8fE_YzNpYlGTBUPzJCz8Ok%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3WpDa%2FiOB2dJArfsdxGkf9lU7KptWAKhf1QrV%2FpzQ2Q%3D&reserved=0> _______________________________________________ OAuth mailing list OAuth@ietf.org<mailto:OAuth@ietf.org> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0&m=laLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc&s=DSum4-_qXZwEKnhYE43SP8fE_YzNpYlGTBUPzJCz8Ok&e=<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__www.ietf.org_mailman_listinfo_oauth%26d%3DDwIGaQ%26c%3DudBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ%26r%3DNMZJHCV8pjvGIH2fTx9z6tOf9bN5lnuu0jl9p1INnD0%26m%3DlaLdZ6c7CRHmE3mvQ2aDBaT2pwnLrnv5tpBSlWrkhQh12iyjLjJHa81GBcZn8pUc%26s%3DDSum4-_qXZwEKnhYE43SP8fE_YzNpYlGTBUPzJCz8Ok%26e%3D&data=05%7C01%7Cpieter.kasselman%40microsoft.com%7C7cbd164bf59942d654b108dab7caebed%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638024379445779026%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3WpDa%2FiOB2dJArfsdxGkf9lU7KptWAKhf1QrV%2FpzQ2Q%3D&reserved=0>
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
