A majority of the people in the poll voted there was not a problem.| Are you a +1 that exfiltration of the authorization code is a problem?
What about that problem was vague in the proposal? On Mon, Sep 28, 2026 at 6:03 PM Aaron Parecki <[email protected]> wrote: > I did. I believe there is a problem to solve, and I don't think the > current draft articulates the problem well or is even necessarily the right > direction for the solution. > > > On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]> wrote: > >> The poll was what people voted on. >> >> The poll was to see if there was agreement that there was a problem to be >> solved. It was not that complicated. I had thought from the mail list that >> there was consensus on wanting to solve the problem. The poll showed >> otherwise. >> >> Rather than arguing about the poll -- you can answer the question I am >> posing. If the list disagrees with the pole, then we can work on the >> problem. If not, then there is no value in working on a problem the WG does >> not think is a problem. >> >> >> >> On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> wrote: >> >>> My understanding of the conversation on the call was that the WG does >>> agree there is a problem, but the draft presented did not articulate the >>> problem well enough. The wording of the poll did not capture the >>> conversation very well. >>> >>> >>> On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> wrote: >>> >>>> I'll repeat, the poll was ""Do people agree there is a problem to be >>>> solved" >>>> >>>> and the votes were a majority *no*. >>>> >>>> None of these agreements came out of the WG call: >>>> >>>> Members of the WG agree there is a problem/smoking gun >>>>> Members of the WG disagree on the breaking change introduce as the >>>>> unitarily option to solve it >>>>> Members of the WG agree to more deeply formalize the problem so that >>>>> additional options to work on could be formalized post adoption >>>> >>>> >>>> And I'm unclear what "the breaking change" is referring to. >>>> >>>> The proposed solution (which was not voted on) does not break anything >>>> existing. It allows incremental deployment. >>>> >>>> >>>> On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> >>>> wrote: >>>> >>>>> I will add my American 2 cents to Jeff's summary. >>>>> >>>>> >>>>> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >>>>> [email protected]> wrote: >>>>> >>>>>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>>>>> >>>>>> "Do people agree there is a problem to be solved" is not a the same >>>>>> of "Do people agree there is a problem to be solved *like that*" as >>>>>> Emelia pointed. >>>>>> >>>>>> >>>>>> >>>>>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>>>>> >>>>>> - Members of the WG agree there is a problem/smoking gun >>>>>> - Members of the WG disagree on the breaking change introduce as >>>>>> the unitarily option to solve it >>>>>> - Members of the WG agree to more deeply formalize the problem so >>>>>> that additional options to work on could be formalized post adoption >>>>>> >>>>>> >>>>>> >>>>>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>>>>> >>>>>> >>>>>> Principal Standards Specialist, Identity Services >>>>>> Montréal, Canada >>>>>> >>>>>> >>>>>> >>>>>> *From:* Dick Hardt <[email protected]> >>>>>> *Sent:* September 28, 2026 8:48 AM >>>>>> *To:* [email protected] >>>>>> *Cc:* Sam Goto <[email protected]> >>>>>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a >>>>>> problem the WG wants to solve? >>>>>> >>>>>> >>>>>> >>>>>> *CAUTION*: This email originated from outside of the organization. >>>>>> Do not click links or open attachments unless you can confirm the sender >>>>>> and know the content is safe. >>>>>> >>>>>> >>>>>> >>>>>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>>>>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si >>>>>> vous >>>>>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >>>>>> certain que le contenu ne présente aucun risque. >>>>>> >>>>>> >>>>>> >>>>>> Checking in to see if this problem is something the WG wants to work >>>>>> on. >>>>>> >>>>>> >>>>>> >>>>>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> >>>>>> wrote: >>>>>> >>>>>> Hi Emilia >>>>>> >>>>>> >>>>>> >>>>>> The poll text was "Do people agree there is a problem to be solved" >>>>>> >>>>>> >>>>>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>>>>> >>>>>> Slide 4 of the presentation was presented during the poll. >>>>>> >>>>>> >>>>>> The poll was not adoption of the draft by the WG. >>>>>> >>>>>> /Dick >>>>>> >>>>>> >>>>>> >>>>>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>>>>> wrote: >>>>>> >>>>>> Hi Dick, >>>>>> >>>>>> >>>>>> >>>>>> My interpretation from yesterday was that we were asked "Do we want >>>>>> to adopt this specific solution" and the answer was "no, because it's >>>>>> unclear if this actually solves the problem or not based on reading the >>>>>> draft text alone" >>>>>> >>>>>> >>>>>> >>>>>> There's no clear definition of the problem, therefore there can't be >>>>>> a solution, yet. >>>>>> >>>>>> >>>>>> >>>>>> — Emelia >>>>>> >>>>>> >>>>>> >>>>>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>>>>> >>>>>> >>>>>> >>>>>> Hey >>>>>> >>>>>> >>>>>> >>>>>> At the September 21 interim [1], the chairs asked if there >>>>>> authorization code exfiltration is a problem to be solved. 3 said yes, 5 >>>>>> said no. >>>>>> >>>>>> >>>>>> >>>>>> The authorization code is a credential that we deliver in the >>>>>> redirect URL. From there it can be exfiltrated through history, logs, >>>>>> Referer, page JavaScript and extensions. Based on the Browser-Swapping >>>>>> thread [2] and the support for Redirect Headers in December [3], I had >>>>>> thought there was consensus that this is a problem. >>>>>> >>>>>> >>>>>> >>>>>> Do you think exfiltration of the authorization code is a problem this >>>>>> WG should solve? >>>>>> >>>>>> >>>>>> >>>>>> /Dick >>>>>> >>>>>> >>>>>> >>>>>> [1] >>>>>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>>>>> >>>>>> [2] >>>>>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>>>>> >>>>>> [3] >>>>>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>>>>> >>>>>> _______________________________________________ >>>>>> OAuth mailing list -- [email protected] >>>>>> To unsubscribe send an email to [email protected] >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> OAuth mailing list -- [email protected] >>>>>> To unsubscribe send an email to [email protected] >>>>>> >>>>>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
