Subject: [abfab] Which approach to choose?

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 9 Aug 2010 21:32:14 +0300

This particular topic is quite a challenging one since the solution
space is extremely large and there is a lot of prior work one could
re-use (or build solutions on top of). 

So, what to do? 

I would actually take the OAuth experience since I consider it as a
success story. 

The opinion of those who contribute open source code (see
http://oauth.net/code/) and deploy it should have more weight. Everyone
can easily come up with new ideas for protocols in this area but without
code and deployment the contribution is fairly useless. 

Hence, the obvious question is: Who is going to write code and who will
deploy? 

Ciao
Hannes

---

From: "Scott Cantor" <[email-masked]>
Date: Mon, 9 Aug 2010 14:39:43 -0400

> I would actually take the OAuth experience since I consider it as a

A widely deployed solution that reduces security in the end has its own
downsides.

> code and deployment the contribution is fairly useless.

Yes, but it has to be the right people. "Everybody who might ever write a
web app" should not be the audience for a security protocol, IMHO, but that
is the benchmark people are shooting for today.

I think there's a middle ground, but today the solutions are targeting the
knowledge extremes, IMHO.

-- Scott

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 9 Aug 2010 21:52:30 +0300

Do I hear a bit of frustration in between the lines? 

I saw a lot of people on the microphone during the BOF who wanted to
work on a different solution. Knowing some of those persons from my IETF
experience I also know that they neither write code nor decide about
deployment. 

Having web developers use good open source libraries is a good start
(ignoring that this group works on non-web based applications). If
nobody understands the result (because it is so complicated) or so
difficult to use then something went wrong. 

> A widely deployed solution that reduces security in the end 

.... in comparison to some other work that never got deployed and people
continued passing their long-term secret to third parties? Hmmm?

---

From: "Scott Cantor" <[email-masked]>
Date: Mon, 9 Aug 2010 15:11:42 -0400

> Do I hear a bit of frustration in between the lines?

Sure. And some fundamental disagreements, to which I'm entitled.

> experience I also know that they neither write code nor decide about

That's fair, I'm just saying that asking app developers to do the work
doesn't get you a good solution either.
 
> difficult to use then something went wrong.

I agree, but there's a strong movement these days to require solutions be
implementable without libraries, or in languages with constraints that make
good solutions unrealistic, and I don't agree with that.
 
> > A widely deployed solution that reduces security in the end
> > has its own downsides.
> 

If that was all I thought it would get used for, I wouldn't be as concerned
about it.

-- Scott