On Tue, Apr 12, 2011 at 7:27 AM, Andrew Arnott wrote:
> I brought this concern up about a year ago. Now reviewing the latest
> drafts, I still have a concern with it. It is regarding the use of
> client_id without a password. I agree with section 3, as included below:
> Section 3. Client Authen
Apr 12, 2011, at 9:28 AM, Eran Hammer-Lahav wrote:
>
> > Hopefully by the end of the week. My farm took all my free time this
> weekend.
> >
> > EHL
> >
> > From: Torsten Lodderstedt [mailto:tors...@lodderstedt.net]
> > Sent: Tuesday, April 12, 2011 8:54 AM
EHL
>
> From: Torsten Lodderstedt [mailto:tors...@lodderstedt.net]
> Sent: Tuesday, April 12, 2011 8:54 AM
> To: Eran Hammer-Lahav
> Cc: Andrew Arnott; OAuth WG (oauth@ietf.org)
> Subject: Re: [OAUTH-WG] client authentication for implicit grant type
>
> The proposed
include a section on phishing-like attacks.
EHL
From: Andrew Arnott [mailto:andrewarn...@gmail.com]
Sent: Tuesday, April 12, 2011 8:30 AM
To: Eran Hammer-Lahav
Cc: OAuth WG (oauth@ietf.org<mailto:oauth@ietf.org>)
Subject: Re: [OAUTH-WG] client authentication for implicit grant type
Thanks
section on phishing-like attacks.
EHL
*From:*Andrew Arnott [mailto:andrewarn...@gmail.com]
*Sent:* Tuesday, April 12, 2011 8:30 AM
*To:* Eran Hammer-Lahav
*Cc:* OAuth WG (oauth@ietf.org)
*Subject:* Re: [OAUTH-WG] client authentication for implicit grant type
Thanks, Eran. Will the security
It should include a section on phishing-like attacks.
EHL
From: Andrew Arnott [mailto:andrewarn...@gmail.com]
Sent: Tuesday, April 12, 2011 8:30 AM
To: Eran Hammer-Lahav
Cc: OAuth WG (oauth@ietf.org)
Subject: Re: [OAUTH-WG] client authentication for implicit grant type
Thanks, Eran. Will the
nt:* Tuesday, April 12, 2011 7:28 AM
> *To:* OAuth WG (oauth@ietf.org)
> *Subject:* [OAUTH-WG] client authentication for implicit grant type
>
>
>
> I brought this concern up about a year ago. Now reviewing the latest
> drafts, I still have a concern with it. It is regarding the u
[mailto:oauth-boun...@ietf.org] On Behalf Of
Andrew Arnott
Sent: Tuesday, April 12, 2011 7:28 AM
To: OAuth WG (oauth@ietf.org)
Subject: [OAUTH-WG] client authentication for implicit grant type
I brought this concern up about a year ago. Now reviewing the latest drafts, I
still have a concern with i
I brought this concern up about a year ago. Now reviewing the latest
drafts, I still have a concern with it. It is regarding the use of
client_id without a password. I agree with section 3, as included below:
Section 3. Client Authentication
The client identifier is not a secret, it is exposed
