Re: [OAUTH-WG] Rate limiting in Dyn-Reg-Management

On 4/3/2015 9:15 PM, Benjamin Kaduk wrote: On Fri, 3 Apr 2015, Justin Richer wrote: In the current draft of Dyn-Reg-Management (https://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-management-12 ) there’s a clause that’s c

Re: [OAUTH-WG] Rate limiting in Dyn-Reg-Management

On Fri, 3 Apr 2015, Justin Richer wrote: > In the current draft of Dyn-Reg-Management > (https://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-management-12 > ) there’s > a clause that’s causing some consternation in the general

Re: [OAUTH-WG] Rate limiting in Dyn-Reg-Management

I am OK with that. Rate limiting only really helps with denial of service attacks, and that is a separate issue. In 6750 we were very slippery in avoiding specifying any entropy minimum or structure for the token, given the nature of that applying to any endpoint. In 6819 we did better by spec

[OAUTH-WG] Rate limiting in Dyn-Reg-Management

In the current draft of Dyn-Reg-Management (https://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-management-12 ) there’s a clause that’s causing some consternation in the general review: Since the client configuration endpoi