I thought we were not talking about the poll anymore. The poll was confusing, and didn't capture the discussion well. I am probably not alone in this, but it took me almost the entire length of the call to remember the context of the problem since the presentation jumped right in to a possible solution.
I agree that the problem described by the researchers about authorization code exfiltration is a problem. I do not think the draft discussed on the call captures the problem statement well. On Mon, Sep 28, 2026 at 10:09 AM Dick Hardt <[email protected]> wrote: > A majority of the people in the poll voted there was not a problem.| > > Are you a +1 that exfiltration of the authorization code is a problem? > > What about that problem was vague in the proposal? > > > > On Mon, Sep 28, 2026 at 6:03 PM Aaron Parecki <[email protected]> wrote: > >> I did. I believe there is a problem to solve, and I don't think the >> current draft articulates the problem well or is even necessarily the right >> direction for the solution. >> >> >> On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]> wrote: >> >>> The poll was what people voted on. >>> >>> The poll was to see if there was agreement that there was a problem to >>> be solved. It was not that complicated. I had thought from the mail list >>> that there was consensus on wanting to solve the problem. The poll showed >>> otherwise. >>> >>> Rather than arguing about the poll -- you can answer the question I am >>> posing. If the list disagrees with the pole, then we can work on the >>> problem. If not, then there is no value in working on a problem the WG does >>> not think is a problem. >>> >>> >>> >>> On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> wrote: >>> >>>> My understanding of the conversation on the call was that the WG does >>>> agree there is a problem, but the draft presented did not articulate the >>>> problem well enough. The wording of the poll did not capture the >>>> conversation very well. >>>> >>>> >>>> On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> >>>> wrote: >>>> >>>>> I'll repeat, the poll was ""Do people agree there is a problem to be >>>>> solved" >>>>> >>>>> and the votes were a majority *no*. >>>>> >>>>> None of these agreements came out of the WG call: >>>>> >>>>> Members of the WG agree there is a problem/smoking gun >>>>>> Members of the WG disagree on the breaking change introduce as the >>>>>> unitarily option to solve it >>>>>> Members of the WG agree to more deeply formalize the problem so that >>>>>> additional options to work on could be formalized post adoption >>>>> >>>>> >>>>> And I'm unclear what "the breaking change" is referring to. >>>>> >>>>> The proposed solution (which was not voted on) does not break anything >>>>> existing. It allows incremental deployment. >>>>> >>>>> >>>>> On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> >>>>> wrote: >>>>> >>>>>> I will add my American 2 cents to Jeff's summary. >>>>>> >>>>>> >>>>>> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >>>>>> [email protected]> wrote: >>>>>> >>>>>>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>>>>>> >>>>>>> "Do people agree there is a problem to be solved" is not a the same >>>>>>> of "Do people agree there is a problem to be solved *like that*" as >>>>>>> Emelia pointed. >>>>>>> >>>>>>> >>>>>>> >>>>>>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>>>>>> >>>>>>> - Members of the WG agree there is a problem/smoking gun >>>>>>> - Members of the WG disagree on the breaking change introduce as >>>>>>> the unitarily option to solve it >>>>>>> - Members of the WG agree to more deeply formalize the problem >>>>>>> so that additional options to work on could be formalized post >>>>>>> adoption >>>>>>> >>>>>>> >>>>>>> >>>>>>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>>>>>> >>>>>>> >>>>>>> Principal Standards Specialist, Identity Services >>>>>>> Montréal, Canada >>>>>>> >>>>>>> >>>>>>> >>>>>>> *From:* Dick Hardt <[email protected]> >>>>>>> *Sent:* September 28, 2026 8:48 AM >>>>>>> *To:* [email protected] >>>>>>> *Cc:* Sam Goto <[email protected]> >>>>>>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration >>>>>>> a problem the WG wants to solve? >>>>>>> >>>>>>> >>>>>>> >>>>>>> *CAUTION*: This email originated from outside of the organization. >>>>>>> Do not click links or open attachments unless you can confirm the sender >>>>>>> and know the content is safe. >>>>>>> >>>>>>> >>>>>>> >>>>>>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>>>>>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si >>>>>>> vous >>>>>>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >>>>>>> certain que le contenu ne présente aucun risque. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Checking in to see if this problem is something the WG wants to work >>>>>>> on. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>> Hi Emilia >>>>>>> >>>>>>> >>>>>>> >>>>>>> The poll text was "Do people agree there is a problem to be solved" >>>>>>> >>>>>>> >>>>>>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>>>>>> >>>>>>> Slide 4 of the presentation was presented during the poll. >>>>>>> >>>>>>> >>>>>>> The poll was not adoption of the draft by the WG. >>>>>>> >>>>>>> /Dick >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>> Hi Dick, >>>>>>> >>>>>>> >>>>>>> >>>>>>> My interpretation from yesterday was that we were asked "Do we want >>>>>>> to adopt this specific solution" and the answer was "no, because it's >>>>>>> unclear if this actually solves the problem or not based on reading the >>>>>>> draft text alone" >>>>>>> >>>>>>> >>>>>>> >>>>>>> There's no clear definition of the problem, therefore there can't be >>>>>>> a solution, yet. >>>>>>> >>>>>>> >>>>>>> >>>>>>> — Emelia >>>>>>> >>>>>>> >>>>>>> >>>>>>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> Hey >>>>>>> >>>>>>> >>>>>>> >>>>>>> At the September 21 interim [1], the chairs asked if there >>>>>>> authorization code exfiltration is a problem to be solved. 3 said yes, 5 >>>>>>> said no. >>>>>>> >>>>>>> >>>>>>> >>>>>>> The authorization code is a credential that we deliver in the >>>>>>> redirect URL. From there it can be exfiltrated through history, logs, >>>>>>> Referer, page JavaScript and extensions. Based on the Browser-Swapping >>>>>>> thread [2] and the support for Redirect Headers in December [3], I had >>>>>>> thought there was consensus that this is a problem. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Do you think exfiltration of the authorization code is a problem >>>>>>> this WG should solve? >>>>>>> >>>>>>> >>>>>>> >>>>>>> /Dick >>>>>>> >>>>>>> >>>>>>> >>>>>>> [1] >>>>>>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>>>>>> >>>>>>> [2] >>>>>>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>>>>>> >>>>>>> [3] >>>>>>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>>>>>> >>>>>>> _______________________________________________ >>>>>>> OAuth mailing list -- [email protected] >>>>>>> To unsubscribe send an email to [email protected] >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> OAuth mailing list -- [email protected] >>>>>>> To unsubscribe send an email to [email protected] >>>>>>> >>>>>>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
