The poll was what people voted on. The poll was to see if there was agreement that there was a problem to be solved. It was not that complicated. I had thought from the mail list that there was consensus on wanting to solve the problem. The poll showed otherwise.
Rather than arguing about the poll -- you can answer the question I am posing. If the list disagrees with the pole, then we can work on the problem. If not, then there is no value in working on a problem the WG does not think is a problem. On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> wrote: > My understanding of the conversation on the call was that the WG does > agree there is a problem, but the draft presented did not articulate the > problem well enough. The wording of the poll did not capture the > conversation very well. > > > On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> wrote: > >> I'll repeat, the poll was ""Do people agree there is a problem to be >> solved" >> >> and the votes were a majority *no*. >> >> None of these agreements came out of the WG call: >> >> Members of the WG agree there is a problem/smoking gun >>> Members of the WG disagree on the breaking change introduce as the >>> unitarily option to solve it >>> Members of the WG agree to more deeply formalize the problem so that >>> additional options to work on could be formalized post adoption >> >> >> And I'm unclear what "the breaking change" is referring to. >> >> The proposed solution (which was not voted on) does not break anything >> existing. It allows incremental deployment. >> >> >> On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> wrote: >> >>> I will add my American 2 cents to Jeff's summary. >>> >>> >>> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >>> [email protected]> wrote: >>> >>>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>>> >>>> "Do people agree there is a problem to be solved" is not a the same of >>>> "Do people agree there is a problem to be solved *like that*" as >>>> Emelia pointed. >>>> >>>> >>>> >>>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>>> >>>> - Members of the WG agree there is a problem/smoking gun >>>> - Members of the WG disagree on the breaking change introduce as >>>> the unitarily option to solve it >>>> - Members of the WG agree to more deeply formalize the problem so >>>> that additional options to work on could be formalized post adoption >>>> >>>> >>>> >>>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>>> >>>> >>>> Principal Standards Specialist, Identity Services >>>> Montréal, Canada >>>> >>>> >>>> >>>> *From:* Dick Hardt <[email protected]> >>>> *Sent:* September 28, 2026 8:48 AM >>>> *To:* [email protected] >>>> *Cc:* Sam Goto <[email protected]> >>>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a >>>> problem the WG wants to solve? >>>> >>>> >>>> >>>> *CAUTION*: This email originated from outside of the organization. Do >>>> not click links or open attachments unless you can confirm the sender and >>>> know the content is safe. >>>> >>>> >>>> >>>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous >>>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >>>> certain que le contenu ne présente aucun risque. >>>> >>>> >>>> >>>> Checking in to see if this problem is something the WG wants to work >>>> on. >>>> >>>> >>>> >>>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> >>>> wrote: >>>> >>>> Hi Emilia >>>> >>>> >>>> >>>> The poll text was "Do people agree there is a problem to be solved" >>>> >>>> >>>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>>> >>>> Slide 4 of the presentation was presented during the poll. >>>> >>>> >>>> The poll was not adoption of the draft by the WG. >>>> >>>> /Dick >>>> >>>> >>>> >>>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>>> wrote: >>>> >>>> Hi Dick, >>>> >>>> >>>> >>>> My interpretation from yesterday was that we were asked "Do we want to >>>> adopt this specific solution" and the answer was "no, because it's unclear >>>> if this actually solves the problem or not based on reading the draft text >>>> alone" >>>> >>>> >>>> >>>> There's no clear definition of the problem, therefore there can't be a >>>> solution, yet. >>>> >>>> >>>> >>>> — Emelia >>>> >>>> >>>> >>>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>>> >>>> >>>> >>>> Hey >>>> >>>> >>>> >>>> At the September 21 interim [1], the chairs asked if there >>>> authorization code exfiltration is a problem to be solved. 3 said yes, 5 >>>> said no. >>>> >>>> >>>> >>>> The authorization code is a credential that we deliver in the redirect >>>> URL. From there it can be exfiltrated through history, logs, Referer, page >>>> JavaScript and extensions. Based on the Browser-Swapping thread [2] and the >>>> support for Redirect Headers in December [3], I had thought there was >>>> consensus that this is a problem. >>>> >>>> >>>> >>>> Do you think exfiltration of the authorization code is a problem this >>>> WG should solve? >>>> >>>> >>>> >>>> /Dick >>>> >>>> >>>> >>>> [1] >>>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>>> >>>> [2] >>>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>>> >>>> [3] >>>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>>> >>>> _______________________________________________ >>>> OAuth mailing list -- [email protected] >>>> To unsubscribe send an email to [email protected] >>>> >>>> >>>> >>>> _______________________________________________ >>>> OAuth mailing list -- [email protected] >>>> To unsubscribe send an email to [email protected] >>>> >>>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
