I did. I believe there is a problem to solve, and I don't think the current draft articulates the problem well or is even necessarily the right direction for the solution.
On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]> wrote: > The poll was what people voted on. > > The poll was to see if there was agreement that there was a problem to be > solved. It was not that complicated. I had thought from the mail list that > there was consensus on wanting to solve the problem. The poll showed > otherwise. > > Rather than arguing about the poll -- you can answer the question I am > posing. If the list disagrees with the pole, then we can work on the > problem. If not, then there is no value in working on a problem the WG does > not think is a problem. > > > > On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> wrote: > >> My understanding of the conversation on the call was that the WG does >> agree there is a problem, but the draft presented did not articulate the >> problem well enough. The wording of the poll did not capture the >> conversation very well. >> >> >> On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> wrote: >> >>> I'll repeat, the poll was ""Do people agree there is a problem to be >>> solved" >>> >>> and the votes were a majority *no*. >>> >>> None of these agreements came out of the WG call: >>> >>> Members of the WG agree there is a problem/smoking gun >>>> Members of the WG disagree on the breaking change introduce as the >>>> unitarily option to solve it >>>> Members of the WG agree to more deeply formalize the problem so that >>>> additional options to work on could be formalized post adoption >>> >>> >>> And I'm unclear what "the breaking change" is referring to. >>> >>> The proposed solution (which was not voted on) does not break anything >>> existing. It allows incremental deployment. >>> >>> >>> On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> wrote: >>> >>>> I will add my American 2 cents to Jeff's summary. >>>> >>>> >>>> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >>>> [email protected]> wrote: >>>> >>>>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>>>> >>>>> "Do people agree there is a problem to be solved" is not a the same of >>>>> "Do people agree there is a problem to be solved *like that*" as >>>>> Emelia pointed. >>>>> >>>>> >>>>> >>>>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>>>> >>>>> - Members of the WG agree there is a problem/smoking gun >>>>> - Members of the WG disagree on the breaking change introduce as >>>>> the unitarily option to solve it >>>>> - Members of the WG agree to more deeply formalize the problem so >>>>> that additional options to work on could be formalized post adoption >>>>> >>>>> >>>>> >>>>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>>>> >>>>> >>>>> Principal Standards Specialist, Identity Services >>>>> Montréal, Canada >>>>> >>>>> >>>>> >>>>> *From:* Dick Hardt <[email protected]> >>>>> *Sent:* September 28, 2026 8:48 AM >>>>> *To:* [email protected] >>>>> *Cc:* Sam Goto <[email protected]> >>>>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a >>>>> problem the WG wants to solve? >>>>> >>>>> >>>>> >>>>> *CAUTION*: This email originated from outside of the organization. Do >>>>> not click links or open attachments unless you can confirm the sender and >>>>> know the content is safe. >>>>> >>>>> >>>>> >>>>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>>>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous >>>>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >>>>> certain que le contenu ne présente aucun risque. >>>>> >>>>> >>>>> >>>>> Checking in to see if this problem is something the WG wants to work >>>>> on. >>>>> >>>>> >>>>> >>>>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> >>>>> wrote: >>>>> >>>>> Hi Emilia >>>>> >>>>> >>>>> >>>>> The poll text was "Do people agree there is a problem to be solved" >>>>> >>>>> >>>>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>>>> >>>>> Slide 4 of the presentation was presented during the poll. >>>>> >>>>> >>>>> The poll was not adoption of the draft by the WG. >>>>> >>>>> /Dick >>>>> >>>>> >>>>> >>>>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>>>> wrote: >>>>> >>>>> Hi Dick, >>>>> >>>>> >>>>> >>>>> My interpretation from yesterday was that we were asked "Do we want to >>>>> adopt this specific solution" and the answer was "no, because it's unclear >>>>> if this actually solves the problem or not based on reading the draft text >>>>> alone" >>>>> >>>>> >>>>> >>>>> There's no clear definition of the problem, therefore there can't be a >>>>> solution, yet. >>>>> >>>>> >>>>> >>>>> — Emelia >>>>> >>>>> >>>>> >>>>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>>>> >>>>> >>>>> >>>>> Hey >>>>> >>>>> >>>>> >>>>> At the September 21 interim [1], the chairs asked if there >>>>> authorization code exfiltration is a problem to be solved. 3 said yes, 5 >>>>> said no. >>>>> >>>>> >>>>> >>>>> The authorization code is a credential that we deliver in the redirect >>>>> URL. From there it can be exfiltrated through history, logs, Referer, page >>>>> JavaScript and extensions. Based on the Browser-Swapping thread [2] and >>>>> the >>>>> support for Redirect Headers in December [3], I had thought there was >>>>> consensus that this is a problem. >>>>> >>>>> >>>>> >>>>> Do you think exfiltration of the authorization code is a problem this >>>>> WG should solve? >>>>> >>>>> >>>>> >>>>> /Dick >>>>> >>>>> >>>>> >>>>> [1] >>>>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>>>> >>>>> [2] >>>>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>>>> >>>>> [3] >>>>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>>>> >>>>> _______________________________________________ >>>>> OAuth mailing list -- [email protected] >>>>> To unsubscribe send an email to [email protected] >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> OAuth mailing list -- [email protected] >>>>> To unsubscribe send an email to [email protected] >>>>> >>>>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
