Subject: [OAUTH-WG] Device Profile

From: Brent Goldman <[email-masked]>
Date: Thu, 11 Mar 2010 02:27:53 -0800

Over the past couple days, Luke Shepard, David Recordon, and I have been brainstorming an OAuth profile for standardizing the flow that devices such as game consoles and entertainment centers use to hook up with services such as Netflix and iTunes. The basic flow is that a device can gain authorization by directing the user to visit a URL on their computer and to enter a verification code copied from the device's screen.

A draft spec is attached to this email. Any thoughts or feedback?

Note: this is one of the many profiles going into the OAuth 2.0 draft that David is writing (http://daveman692.livejournal.com/349384.html).

-Brent

---

From: "Shafi, Saleem" <[email-masked]>
Date: Tue, 16 Mar 2010 12:19:48 -0700

Hello..
 
Is there any interest in being able to respond with multiple oauth_verification_url values?  I can forsee the possibility of the Authorization Server being able to support browser-based user verification (http/https) or text messages (assuming we could authenticate the user on sending the SMS)..  Letting the authorization server return multiple URLs could give the client/user more options..
 
Also, would there be room in this profile for a scenario where the user verification code isn't returned to the client, but rather sent to the user directly?  If the initial request that the client makes includes some identifier for the user and the authorization server has contact information for that user, could the AS inform the user (via email, sms, IVR, etc) of a one-time user code that they would enter into the device*?  It's sort of the reverse model, but it should still establish a connection between the device, AS and user..  This profile might make sense where the device has very simple data entry options and the user might not be near a browser-capable device..
 
Saleem.

*Eve points out that this is somewhat simliar to the verification_code addition in the Oauth 1.0a spec to protect against session-fixation attacks (http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/), especially the way it's communicated in WRAP's Rich App profile when the app in question can't be contacted by the AS with a URL..

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Brent Goldman
Sent: Thursday, March 11, 2010 4:28 AM
To: OAuth WG ([email-masked])
Subject: [OAUTH-WG] Device Profile

-Brent

---

From: Brent Goldman <[email-masked]>
Date: Wed, 17 Mar 2010 04:42:53 -0700

> Is there any interest in being able to respond with multiple oauth_verification_url values?  I can forsee the possibility of the Authorization Server being able to support browser-based user verifi…

Authenticating the user via text message is an awesome idea, but we can't really communicate that to the device as another oauth_verification_url. This is probably worthy of another profile. Using SMS to auth could also be useful at an untrusted computer at an internet cafe -- maybe you don't want to authenticate yourself with the AS via password in case a keylogger is installed.

> Also, would there be room in this profile for a scenario where the user verification code isn't returned to the client, but rather sent to the user directly?  If the initial request that the client…

I'm not sure I like the reverse of this scenario. What stops other people from entering my identifier into their device, thus causing the AS to ping me via email or SMS? Also, the Device Profile was created as the reverse of OAuth, so the reverse of the Device Profile is just a variation on regular OAuth! Maybe this could be developed into yet another profile.

-Brent

---

From: "Shafi, Saleem" <[email-masked]>
Date: Wed, 17 Mar 2010 13:44:48 -0700

> Authenticating the user via text message is an awesome idea, but we can't really communicate that to the device as another
> oauth_verification_url. This is probably worthy of another profile. Using SMS to auth could also be useful at an untrusted
> computer at an internet cafe -- maybe you don't want to authenticate yourself with the AS via password in case a keylogger
> is installed. 

I'm not sure I understand why we couldn't use the oauth_verification_url for this..  Following RFC 5724 (http://tools.ietf.org/html/rfc5724), couldn't we have something like this:

    HTTP/1.1 200 OK
    Content-Type: application/x-www-form-urlencoded

    oauth_device_code=74tq5miHKB&oauth_user_code=94248&oauth_verification_url=http%3A%2F%2Fwww%2Eexample%2Ecom%2Fdevice&oauth_verification_url=sms%3A%2B180080080000

Then the client could display the option to the user to either visit http://www.example.com/device or send an SMS to 1-800-800-8000

> I'm not sure I like the reverse of this scenario. What stops other people from entering my identifier into their device,
> thus causing the AS to ping me via email or SMS? Also, the Device Profile was created as the reverse of OAuth, so the reverse
> of the Device Profile is just a variation on regular OAuth! Maybe this could be developed into yet another profile.

You're right, spam could be a problem, but it would be a user annoyance issue that could be mitigated by the Authorization Server much like any other spam filter might..  E.g., users could opt-out/opt-in to the entire process, or allow only certain devices/clients to communicate with them, etc..  In any case, I don't think it would pose a security risk since I simply wouldn't enter the code I received into the device if I wasn't the one that initiated it and am probably not physically at the device anyway..

Perhaps it doesn't make sense to lump this in with the device profile you've defined since the process is different enough, but I think the use cases overlap..  The only difference really is that in your flow, the user code travels from the AS to the client to the user and back to the AS; whereas in the flow I've described, it flows from the AS to the user to the client back to the AS..  Which direction the code travels depends on what kind of input options are available and the relationship between the AS and user..

Saleem.

-----Original Message-----
From: Brent Goldman [mailto:[email-masked]] 
Sent: Wednesday, March 17, 2010 6:43 AM
To: Shafi, Saleem
Cc: OAuth WG ([email-masked])
Subject: Re: Device Profile

-Brent

---

From: Brent Goldman <[email-masked]>
Date: Wed, 17 Mar 2010 13:57:50 -0700

I wasn't aware of RFC 5724; using URLs to represent SMS numbers is pretty sweet. It sounds like we should be able to work that into the spec.

Text messages reminded me of another way for the user to communicate the verification code to the AS -- mobile apps. E.g., if the user initiates a link on their Roku device to Netflix, then instead of loading up netflix.com/roku (or whatever the URL is) to enter the code, they can just load up the Netflix iPhone app. I don't think this can be represented with URLs, but perhaps can be expressed if there was a text field in the response to be displayed to the user (e.g., "Use the Netflix iPhone app instead!").

-Brent

---

From: Eric Sachs <[email-masked]>
Date: Wed, 17 Mar 2010 17:45:26 -0700

Google has a similar requirement to move these types of devices to
OAuth/WRAP and away from our older "ClientLogin" protocol where the user is
prompted for their username/password.  The proposed profile looks fine, but
we are a few weeks from being able to do specific work on it, so we may have
more feedback at that time.

If the device can accept some user input, then there are some security
advantages to requiring the user to get the code from their computer and
then enter it into the device.  In particular, it makes it easier to protect
against a DOS attack targeted at the service-provider to request a large #
of codes.  That method also reduces the risk of a phishing/session-fixation
type attack.  However we agree that some profile is needed for devices with
no user input.  We also expect it will be easier to get these device vendors
to use a common industry technique, so we are fine with prioritizing our
support for this profile.  Longer term the community could define a profile
where the code is displayed on the computer.

On Thu, Mar 11, 2010 at 3:27 AM, Brent Goldman <[email-masked]> wrote:

> Over the past couple days, Luke Shepard, David Recordon, and I have been
> brainstorming an OAuth profile for standardizing the flow that devices such
> as game consoles and entertainment centers use to hook up with services such
> as Netflix and iTunes. The basic flow is that a device can gain
> authorization by directing the user to visit a URL on their computer and to
> enter a verification code copied from the device's screen.
>
> Note: this is one of the many profiles going into the OAuth 2.0 draft that
> David is writing (http://daveman692.livejournal.com/349384.html).
>
> -Brent
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>