No, we are still talking about the poll -- as the poll indicated there was not consensus on solving the problem -- so I am going to the list to see if that reflects the WG interest.
So far, it only seems like you and maybe Jeff are interested. Its not clear what Emelia thinks. The second slide was about the problem, and it was the slide being shown during the poll. If I recall correctly, you were in an airport -- so perhaps you missed some of those aspects. On Mon, Sep 28, 2026 at 6:19 PM Aaron Parecki <[email protected]> wrote: > I thought we were not talking about the poll anymore. > > The poll was confusing, and didn't capture the discussion well. I am > probably not alone in this, but it took me almost the entire length of the > call to remember the context of the problem since the presentation jumped > right in to a possible solution. > > I agree that the problem described by the researchers about authorization > code exfiltration is a problem. I do not think the draft discussed on the > call captures the problem statement well. > > > On Mon, Sep 28, 2026 at 10:09 AM Dick Hardt <[email protected]> wrote: > >> A majority of the people in the poll voted there was not a problem.| >> >> Are you a +1 that exfiltration of the authorization code is a problem? >> >> What about that problem was vague in the proposal? >> >> >> >> On Mon, Sep 28, 2026 at 6:03 PM Aaron Parecki <[email protected]> wrote: >> >>> I did. I believe there is a problem to solve, and I don't think the >>> current draft articulates the problem well or is even necessarily the right >>> direction for the solution. >>> >>> >>> On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]> wrote: >>> >>>> The poll was what people voted on. >>>> >>>> The poll was to see if there was agreement that there was a problem to >>>> be solved. It was not that complicated. I had thought from the mail list >>>> that there was consensus on wanting to solve the problem. The poll showed >>>> otherwise. >>>> >>>> Rather than arguing about the poll -- you can answer the question I am >>>> posing. If the list disagrees with the pole, then we can work on the >>>> problem. If not, then there is no value in working on a problem the WG does >>>> not think is a problem. >>>> >>>> >>>> >>>> On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> >>>> wrote: >>>> >>>>> My understanding of the conversation on the call was that the WG does >>>>> agree there is a problem, but the draft presented did not articulate the >>>>> problem well enough. The wording of the poll did not capture the >>>>> conversation very well. >>>>> >>>>> >>>>> On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> >>>>> wrote: >>>>> >>>>>> I'll repeat, the poll was ""Do people agree there is a problem to be >>>>>> solved" >>>>>> >>>>>> and the votes were a majority *no*. >>>>>> >>>>>> None of these agreements came out of the WG call: >>>>>> >>>>>> Members of the WG agree there is a problem/smoking gun >>>>>>> Members of the WG disagree on the breaking change introduce as the >>>>>>> unitarily option to solve it >>>>>>> Members of the WG agree to more deeply formalize the problem so that >>>>>>> additional options to work on could be formalized post adoption >>>>>> >>>>>> >>>>>> And I'm unclear what "the breaking change" is referring to. >>>>>> >>>>>> The proposed solution (which was not voted on) does not break >>>>>> anything existing. It allows incremental deployment. >>>>>> >>>>>> >>>>>> On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> I will add my American 2 cents to Jeff's summary. >>>>>>> >>>>>>> >>>>>>> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >>>>>>> [email protected]> wrote: >>>>>>> >>>>>>>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>>>>>>> >>>>>>>> "Do people agree there is a problem to be solved" is not a the same >>>>>>>> of "Do people agree there is a problem to be solved *like that*" >>>>>>>> as Emelia pointed. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>>>>>>> >>>>>>>> - Members of the WG agree there is a problem/smoking gun >>>>>>>> - Members of the WG disagree on the breaking change introduce >>>>>>>> as the unitarily option to solve it >>>>>>>> - Members of the WG agree to more deeply formalize the problem >>>>>>>> so that additional options to work on could be formalized post >>>>>>>> adoption >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>>>>>>> >>>>>>>> >>>>>>>> Principal Standards Specialist, Identity Services >>>>>>>> Montréal, Canada >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *From:* Dick Hardt <[email protected]> >>>>>>>> *Sent:* September 28, 2026 8:48 AM >>>>>>>> *To:* [email protected] >>>>>>>> *Cc:* Sam Goto <[email protected]> >>>>>>>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration >>>>>>>> a problem the WG wants to solve? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *CAUTION*: This email originated from outside of the organization. >>>>>>>> Do not click links or open attachments unless you can confirm the >>>>>>>> sender >>>>>>>> and know the content is safe. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>>>>>>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si >>>>>>>> vous >>>>>>>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes >>>>>>>> pas >>>>>>>> certain que le contenu ne présente aucun risque. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Checking in to see if this problem is something the WG wants to >>>>>>>> work on. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>> Hi Emilia >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> The poll text was "Do people agree there is a problem to be solved" >>>>>>>> >>>>>>>> >>>>>>>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>>>>>>> >>>>>>>> Slide 4 of the presentation was presented during the poll. >>>>>>>> >>>>>>>> >>>>>>>> The poll was not adoption of the draft by the WG. >>>>>>>> >>>>>>>> /Dick >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>> Hi Dick, >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> My interpretation from yesterday was that we were asked "Do we want >>>>>>>> to adopt this specific solution" and the answer was "no, because it's >>>>>>>> unclear if this actually solves the problem or not based on reading the >>>>>>>> draft text alone" >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> There's no clear definition of the problem, therefore there can't >>>>>>>> be a solution, yet. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> — Emelia >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Hey >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> At the September 21 interim [1], the chairs asked if there >>>>>>>> authorization code exfiltration is a problem to be solved. 3 said yes, >>>>>>>> 5 >>>>>>>> said no. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> The authorization code is a credential that we deliver in the >>>>>>>> redirect URL. From there it can be exfiltrated through history, logs, >>>>>>>> Referer, page JavaScript and extensions. Based on the Browser-Swapping >>>>>>>> thread [2] and the support for Redirect Headers in December [3], I had >>>>>>>> thought there was consensus that this is a problem. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Do you think exfiltration of the authorization code is a problem >>>>>>>> this WG should solve? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> /Dick >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> [1] >>>>>>>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>>>>>>> >>>>>>>> [2] >>>>>>>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>>>>>>> >>>>>>>> [3] >>>>>>>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> OAuth mailing list -- [email protected] >>>>>>>> To unsubscribe send an email to [email protected] >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> OAuth mailing list -- [email protected] >>>>>>>> To unsubscribe send an email to [email protected] >>>>>>>> >>>>>>>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
