<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I think even if we remove it we should maintain a public client section that says something along the lines of:</div><div class=""><br class=""></div><div class="">"There do not currently appear to be any techniques that make public clients sufficiently secure to be considered Financial-grade for write operations.</div><div class=""><br class=""></div><div class="">Wherever possible, it is recommended to use dynamically registered confidential clients instead of public clients. Where the use of public clients is unavoidable, the recommendations in FAPI-R should be followed."</div><div class=""><br class=""></div><div class="">Possibly a recommendation to use token bound refresh tokens and access tokens should be included? (Though I’m not sure that today this is really a realistic recommendation given the lack of support for token binding in many popular technology stacks.)</div><div class="">Certainly I think we can mention <a href="https://tools.ietf.org/html/draft-ietf-oauth-mtls-12#section-4.3" class="">https://tools.ietf.org/html/draft-ietf-oauth-mtls-12#section-4.3</a> "4.3. Certificate Bound Access Tokens Without Client Authentication”. Device attestations may be worth a mention.</div><div class=""><br class=""></div><div class="">I think the first-party app case is interesting and I’d love to hear any insights around how first party banking apps (and for that matter, first party TPP apps that show banking data and/or allow the initiation of payments) work currently. I’m pretty certain the overwhelming majority do not use oauth and/or do not follow the native apps bcp. Without knowing what techniques the average app uses, it’s not clear to me what the level of acceptable security for a mobile banking app is today. The recent experience of moving to a new iPhone suggested to me that a non-negligible percentage do not use techniques like private keys tied to the device's Secure Enclave, which was a surprise.</div><div class=""><br class=""></div><div class="">Joseph</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">On 3 Jan 2019, at 00:26, Dave Tonge via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" class="">openid-specs-fapi@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Dear FAPI WG</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br class=""></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">We very briefly discussed the issue of Public Client support on the call today and I said I'd email the list.</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br class=""></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">We have two issues open:</div><div class="gmail_default"><font face="trebuchet ms, sans-serif" class=""><a href="https://bitbucket.org/openid/fapi/issues/158/fapi-part-2-request-object-for-public" class="">https://bitbucket.org/openid/fapi/issues/158/fapi-part-2-request-object-for-public</a></font><br class=""></div><div class="gmail_default"><font face="trebuchet ms, sans-serif" class=""><a href="https://bitbucket.org/openid/fapi/issues/170/remove-public-client-support" class="">https://bitbucket.org/openid/fapi/issues/170/remove-public-client-support</a><br class=""></font></div><div class="gmail_default"><font face="trebuchet ms, sans-serif" class=""><br class=""></font></div><div class="gmail_default"><font face="trebuchet ms, sans-serif" class="">From my perspective the key argument to remove support for public clients is:</font></div><div class="gmail_default"><b class="">It is harder to implement secure public clients, the spec would be simpler if we just removed support.</b></div><div class="gmail_default"><b class=""><br class=""></b></div><div class="gmail_default">The key argument to include support is:</div><div class="gmail_default"><b class="">The FAPI specs are not just for use in PSD2 style APIs where a confidential client is required. Rather the specs are intended to also support first party clients, for example a bank or TPP implementing its own app. People will implement such apps using public clients so we should provide guidance on how to do it securely.</b></div><div class="gmail_default"><b class=""><br class=""></b></div><div class="gmail_default">It would be good to get feedback from the list on this. </div><div class="gmail_default"><br class=""></div><div class="gmail_default">Thanks</div><div class="gmail_default"><br class=""></div>-- <br class=""><div dir="ltr" class="gmail_signature"><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div style="font-size:1em;font-weight:bold;line-height:1.4" class=""><div style="color:rgb(97,97,97);font-family:"Open Sans";font-size:14px;font-weight:normal;line-height:21px" class=""><div style="font-family:Arial,Helvetica,sans-serif;font-size:0.925em;line-height:1.4;color:rgb(220,41,30);font-weight:bold" class=""><div style="font-size:14px;font-weight:normal;color:rgb(51,51,51);font-family:lato,"open sans",arial,sans-serif;line-height:normal" class=""><div style="color:rgb(0,164,183);font-weight:bold;font-size:1em;line-height:1.4" class=""><div style="font-weight:400;color:rgb(51,51,51);line-height:normal" class=""><div style="color:rgb(0,164,183);font-weight:bold;font-size:1em;line-height:1.4" class="">Dave Tonge</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
_______________________________________________<br class="">Openid-specs-fapi mailing list<br class=""><a href="mailto:Openid-specs-fapi@lists.openid.net" class="">Openid-specs-fapi@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-fapi<br class=""></div></blockquote></div><br class=""></body></html>