English it not my native language. I can only provide apologies for that. It seems I said: “Yes from the literature and the threat modelling done so far there is actually a problem if 2 high bar conditions are met” but “if there no more critical [path for this threat] this does not seem to be a problem to solve more than with guidance in RFC 97000 then”.
I hope this clarifies. Jean-François “Jeff” Lombardo | Amazon Web Services Principal Standards Specialist, Identity Services Montréal, Canada From: Dick Hardt <[email protected]> Sent: September 28, 2026 1:27 PM To: Lombardo, Jeff <[email protected]> Cc: Aaron Parecki <[email protected]>; [email protected]; Sam Goto <[email protected]> Subject: RE: [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a problem the WG wants to solve? CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque. I'm not the one that brought the threats to the working group. I was proposing a solution to what I thought there had been consensus on a problem which was exfiltration of the authorization code. It sounds like you don't know if exfiltration of the authorization code is a problem. On Mon, Sep 28, 2026 at 6:23 PM Lombardo, Jeff <[email protected]<mailto:[email protected]>> wrote: I concur with Aaron. I am “No opinion” which meant both Yes and No. It is only a 3 options choice, there were 4 it would have been “More data needed”. In a nutshell: - Yes from the literature and the threat modelling done so far there is actually a problem if 2 high bar conditions are met: 1. I ask a person to click a link that I have started (the start of an authorization request) 2. The person comes back telling me this does not work and provide the callback request URI containing the code to demonstrate their point to me, which I can then use to finalize the flow - No, if there no more critical risk this does not seem to be a problem to solve more than with guidance in RFC 97000 then. Therefore the “we need more details: are they other form of this threat?” Jean-François “Jeff” Lombardo | Amazon Web Services Principal Standards Specialist, Identity Services Montréal, Canada From: Aaron Parecki <[email protected]<mailto:[email protected]>> Sent: September 28, 2026 1:19 PM To: [email protected]<mailto:[email protected]> Cc: Lombardo, Jeff <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>; Sam Goto <[email protected]<mailto:[email protected]>> Subject: RE: [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a problem the WG wants to solve? CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque. I thought we were not talking about the poll anymore. The poll was confusing, and didn't capture the discussion well. I am probably not alone in this, but it took me almost the entire length of the call to remember the context of the problem since the presentation jumped right in to a possible solution. I agree that the problem described by the researchers about authorization code exfiltration is a problem. I do not think the draft discussed on the call captures the problem statement well. On Mon, Sep 28, 2026 at 10:09 AM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: A majority of the people in the poll voted there was not a problem.| Are you a +1 that exfiltration of the authorization code is a problem? What about that problem was vague in the proposal? On Mon, Sep 28, 2026 at 6:03 PM Aaron Parecki <[email protected]<mailto:[email protected]>> wrote: I did. I believe there is a problem to solve, and I don't think the current draft articulates the problem well or is even necessarily the right direction for the solution. On Mon, Sep 28, 2026 at 9:57 AM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: The poll was what people voted on. The poll was to see if there was agreement that there was a problem to be solved. It was not that complicated. I had thought from the mail list that there was consensus on wanting to solve the problem. The poll showed otherwise. Rather than arguing about the poll -- you can answer the question I am posing. If the list disagrees with the pole, then we can work on the problem. If not, then there is no value in working on a problem the WG does not think is a problem. On Mon, Sep 28, 2026 at 5:49 PM Aaron Parecki <[email protected]<mailto:[email protected]>> wrote: My understanding of the conversation on the call was that the WG does agree there is a problem, but the draft presented did not articulate the problem well enough. The wording of the poll did not capture the conversation very well. On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: I'll repeat, the poll was ""Do people agree there is a problem to be solved" and the votes were a majority no. None of these agreements came out of the WG call: Members of the WG agree there is a problem/smoking gun Members of the WG disagree on the breaking change introduce as the unitarily option to solve it Members of the WG agree to more deeply formalize the problem so that additional options to work on could be formalized post adoption And I'm unclear what "the breaking change" is referring to. The proposed solution (which was not voted on) does not break anything existing. It allows incremental deployment. On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]<mailto:[email protected]>> wrote: I will add my American 2 cents to Jeff's summary. On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <[email protected]<mailto:[email protected]>> wrote: Are you, Emelia and Dick [and all who voted], saying the same thing? "Do people agree there is a problem to be solved" is not a the same of "Do people agree there is a problem to be solved like that" as Emelia pointed. My 2 Canadian cents (roughly 0.1 US cent those days) is that: * Members of the WG agree there is a problem/smoking gun * Members of the WG disagree on the breaking change introduce as the unitarily option to solve it * Members of the WG agree to more deeply formalize the problem so that additional options to work on could be formalized post adoption Jean-François “Jeff” Lombardo | Amazon Web Services Principal Standards Specialist, Identity Services Montréal, Canada From: Dick Hardt <[email protected]<mailto:[email protected]>> Sent: September 28, 2026 8:48 AM To: [email protected]<mailto:[email protected]> Cc: Sam Goto <[email protected]<mailto:[email protected]>> Subject: [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a problem the WG wants to solve? CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque. Checking in to see if this problem is something the WG wants to work on. On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: Hi Emilia The poll text was "Do people agree there is a problem to be solved" https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ Slide 4 of the presentation was presented during the poll. The poll was not adoption of the draft by the WG. /Dick On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]<mailto:[email protected]>> wrote: Hi Dick, My interpretation from yesterday was that we were asked "Do we want to adopt this specific solution" and the answer was "no, because it's unclear if this actually solves the problem or not based on reading the draft text alone" There's no clear definition of the problem, therefore there can't be a solution, yet. — Emelia On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]<mailto:[email protected]>> wrote: Hey At the September 21 interim [1], the chairs asked if there authorization code exfiltration is a problem to be solved. 3 said yes, 5 said no. The authorization code is a credential that we deliver in the redirect URL. From there it can be exfiltrated through history, logs, Referer, page JavaScript and extensions. Based on the Browser-Swapping thread [2] and the support for Redirect Headers in December [3], I had thought there was consensus that this is a problem. Do you think exfiltration of the authorization code is a problem this WG should solve? /Dick [1] https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth [2] https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ [3] https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]> _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
