[OAUTH-WG] OAuth 1.0 PLAINTEXT without SSL/TLS

Eran Hammer-Lahav <eran@hueniverse.com> Sat, 09 January 2010 02:15 UTC

From: Eran Hammer-Lahav <eran@hueniverse.com>
To: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>, "oauth@googlegroups.com" <oauth@googlegroups.com>
Date: Fri, 08 Jan 2010 19:15:21 -0700
Thread-Topic: OAuth 1.0 PLAINTEXT without SSL/TLS
Thread-Index: AcqQ0Zhc5Ipm+e5/S5Sab0hJ0rIhkg==
Message-ID: <90C41DD21FB7C64BB94121FBBC2E72343787F3416B@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [OAUTH-WG] OAuth 1.0 PLAINTEXT without SSL/TLS
Precedence: list

I no longer think there is a valid reason why the OAuth 1.0 specification does not mandate using a secure channel with PLAINTEXT, and I would like to make this change from SHOULD to MUST in the RFC draft [1].

Is there anyone using OAuth PLAINTEXT *not* over TLS/SSL? Is there a *good* reason why the 1.0 specification should not mandate using a secure channel for PLAINTEXT? If someone really wants to use it without, it's a free country but I can't think of any reason.

The only reason not to make the change is if there are existing deployed use cases where PLAINTEXT is used in such a way. If there are none after two years, we should not allow it moving forward.

EHL

[1] http://tools.ietf.org/html/draft-hammer-oauth

[OAUTH-WG] OAuth 1.0 PLAINTEXT without SSL/TLS Eran Hammer-Lahav
Re: [OAUTH-WG] OAuth 1.0 PLAINTEXT without SSL/TLS Igor Faynberg
Re: [OAUTH-WG] [oauth] OAuth 1.0 PLAINTEXT withou… John Kemp
Re: [OAUTH-WG] [oauth] OAuth 1.0 PLAINTEXT withou… Blaine Cook
Re: [OAUTH-WG] [oauth] OAuth 1.0 PLAINTEXT withou… Eran Hammer-Lahav
Re: [OAUTH-WG] OAuth 1.0 PLAINTEXT without SSL/TLS John Panzer
Re: [OAUTH-WG] [oauth] OAuth 1.0 PLAINTEXT withou… John Kemp