I'm not the one that brought the threats to the working group. I was proposing a solution to what I thought there had been consensus on a problem which was exfiltration of the authorization code.
It sounds like you don't know if exfiltration of the authorization code is a problem. On Mon, Sep 28, 2026 at 6:23 PM Lombardo, Jeff <[email protected]> wrote: > I concur with Aaron. I am “No opinion” which meant both Yes and No. It is > only a 3 options choice, there were 4 it would have been “More data needed”. > > In a nutshell: > - Yes from the literature and the threat modelling done so far there is > actually a problem if 2 high bar conditions are met: > > > 1. I ask a person to click a link that I have started (the start of > an authorization request) > 2. The person comes back telling me this does not work and provide the > callback request URI containing the code to demonstrate their point to me, > which I can then use to finalize the flow > > > > - No, if there no more critical risk this does not seem to be a problem to > solve more than with guidance in RFC 97000 then. > > Therefore the “we need more details: are they other form of this threat?” > > > > *Jean-François “Jeff” Lombardo* | Amazon Web Services > > > Principal Standards Specialist, Identity Services > Montréal, Canada > > > > *From:* Aaron Parecki <[email protected]> > *Sent:* September 28, 2026 1:19 PM > *To:* [email protected] > *Cc:* Lombardo, Jeff <[email protected]>; [email protected]; Sam Goto < > [email protected]> > *Subject:* RE: [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a > problem the WG wants to solve? > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and know > the content is safe. > > > > *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur > externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous > ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas > certain que le contenu ne présente aucun risque. > > > > I thought we were not talking about the poll anymore. > > > > The poll was confusing, and didn't capture the discussion well. I am > probably not alone in this, but it took me almost the entire length of the > call to remember the context of the problem since the presentation jumped > right in to a possible solution. > > > > I agree that the problem described by the researchers about authorization > code exfiltration is a problem. I do not think the draft discussed on the > call captures the problem statement well. > > > > > > On Mon, Sep 28, 2026 at 10:09 AM Dick Hardt <[email protected]> wrote: > > A majority of the people in the poll voted there was not a problem.| > > Are you a +1 that exfiltration of the authorization code is a problem? > > What about that problem was vague in the proposal? > > > > On Mon, Sep 28, 2026 at 6:03 PM Aaron Parecki <[email protected]> wrote: > > I did. I believe there is a problem to solve, and I don't think the > current draft articulates the problem well or is even necessarily the right > direction for the solution. > > > > > > On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]> wrote: > > The poll was what people voted on. > > The poll was to see if there was agreement that there was a problem to be > solved. It was not that complicated. I had thought from the mail list that > there was consensus on wanting to solve the problem. The poll showed > otherwise. > > Rather than arguing about the poll -- you can answer the question I am > posing. If the list disagrees with the pole, then we can work on the > problem. If not, then there is no value in working on a problem the WG does > not think is a problem. > > > > On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]> wrote: > > My understanding of the conversation on the call was that the WG does > agree there is a problem, but the draft presented did not articulate the > problem well enough. The wording of the poll did not capture the > conversation very well. > > > > > > On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> wrote: > > I'll repeat, the poll was ""Do people agree there is a problem to be > solved" > > and the votes were a majority *no*. > > None of these agreements came out of the WG call: > > Members of the WG agree there is a problem/smoking gun > Members of the WG disagree on the breaking change introduce as the > unitarily option to solve it > Members of the WG agree to more deeply formalize the problem so that > additional options to work on could be formalized post adoption > > > > And I'm unclear what "the breaking change" is referring to. > > The proposed solution (which was not voted on) does not break anything > existing. It allows incremental deployment. > > > > On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> wrote: > > I will add my American 2 cents to Jeff's summary. > > > > > > On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= > [email protected]> wrote: > > Are you, Emelia and Dick [and all who voted], saying the same thing? > > "Do people agree there is a problem to be solved" is not a the same of "Do > people agree there is a problem to be solved *like that*" as Emelia > pointed. > > > > My 2 Canadian cents (roughly 0.1 US cent those days) is that: > > - Members of the WG agree there is a problem/smoking gun > - Members of the WG disagree on the breaking change introduce as the > unitarily option to solve it > - Members of the WG agree to more deeply formalize the problem so that > additional options to work on could be formalized post adoption > > > > *Jean-François “Jeff” Lombardo* | Amazon Web Services > > > Principal Standards Specialist, Identity Services > Montréal, Canada > > > > *From:* Dick Hardt <[email protected]> > *Sent:* September 28, 2026 8:48 AM > *To:* [email protected] > *Cc:* Sam Goto <[email protected]> > *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a > problem the WG wants to solve? > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and know > the content is safe. > > > > *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur > externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous > ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas > certain que le contenu ne présente aucun risque. > > > > Checking in to see if this problem is something the WG wants to work on. > > > > On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> wrote: > > Hi Emilia > > > > The poll text was "Do people agree there is a problem to be solved" > > https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ > > Slide 4 of the presentation was presented during the poll. > > > The poll was not adoption of the draft by the WG. > > /Dick > > > > On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> wrote: > > Hi Dick, > > > > My interpretation from yesterday was that we were asked "Do we want to > adopt this specific solution" and the answer was "no, because it's unclear > if this actually solves the problem or not based on reading the draft text > alone" > > > > There's no clear definition of the problem, therefore there can't be a > solution, yet. > > > > — Emelia > > > > On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: > > > > Hey > > > > At the September 21 interim [1], the chairs asked if there authorization > code exfiltration is a problem to be solved. 3 said yes, 5 said no. > > > > The authorization code is a credential that we deliver in the redirect > URL. From there it can be exfiltrated through history, logs, Referer, page > JavaScript and extensions. Based on the Browser-Swapping thread [2] and the > support for Redirect Headers in December [3], I had thought there was > consensus that this is a problem. > > > > Do you think exfiltration of the authorization code is a problem this WG > should solve? > > > > /Dick > > > > [1] > https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth > > [2] > https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ > > [3] > https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] > > > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] > >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
