<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I think it is a IdP UI issue. The grant of a user-ID token needs to be clearly separated from the user info endpoint grant and other grants.<div><br></div><div>I don't know how far we want to go with being specific about UI. I would be tempted to recommend that the UI be granular enough to allow individual scopes to be denied.</div><div><br></div><div>Personally I don't give Facebook enabled apps access because I don't have a way to turn off posting to my feed when they ask for a bunch of grants. </div><div><br></div><div>I think it probably should be left up to the IdP to decide on the best interface.</div><div><br></div><div>John B.<br><div><div>On 2011-04-21, at 12:57 PM, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi. <div><br></div><div>I was tweeting with a friend of mine in Japanese about attacker disguising to be just requesting authentication and a bit more and in fact getting fairly large access privilege. </div><div><br></div>
<div>For example, let the client request scope=openid%20readwirte saying that "Please login by clicking this button" or login icon. </div><div>The use is redirected to the client and presses OK without reading about what you are about to give up. </div>
<div>He is just thinking that it is authentication - not a big deal, and only at a later date that something is massively wrong. </div><div><br></div><div>What can we do to mitigate this problem? </div><div> <br clear="all">
<br>-- <br>Nat Sakimura (=nat)<br><a href="http://www.sakimura.org/en/">http://www.sakimura.org/en/</a><br><a href="http://twitter.com/_nat_en">http://twitter.com/_nat_en</a><br>
</div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></body></html>