<div dir="ltr">Security Considerations<div><br></div><div>While it is possible to assign handlers to URIs, and it is possible that the o/s could help the user select the correct handler, it is not possible to guarantee that the handler for a given URI has not been completely taken over by a subsequently installed native app. At the time this was written there appears to be no fool-proof mitigation for this vulnerability.</div><div><br></div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><span style="background-color:rgb(242,242,242);color:rgba(0,0,0,0.9);font-family:-apple-system,system-ui,system-ui,"Segoe UI",Roboto,"Helvetica Neue","Fira Sans",Ubuntu,Oxygen,"Oxygen Sans",Cantarell,"Droid Sans","Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Lucida Grande",Helvetica,Arial,sans-serif;font-size:14px;white-space:pre-wrap">Be the change you want to see in the world </span>..tom</div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Sep 23, 2023 at 1:19 PM Michael Jones <<a href="mailto:michael_b_jones@hotmail.com">michael_b_jones@hotmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5299634883519238323">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_5299634883519238323WordSection1">
<p class="MsoNormal">Thanks for writing this feedback, Tom. Can you propose the additional security considerations text that you’d like to see included?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> Thanks,<u></u><u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Tom Jones via Openid-specs-ab<br>
<b>Sent:</b> Monday, August 14, 2023 9:54 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Tom Jones <<a href="mailto:thomasclinganjones@gmail.com" target="_blank">thomasclinganjones@gmail.com</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Candidate OpenID Connect errata correction drafts published<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I read thru the oidc errata - mostly good.<u></u><u></u></p>
<div>
<p class="MsoNormal">One concern is section 16;23 which describes the iOS ability to assign handlers. The paragraph is correct, but there are severe security considerations to this solution that are not included in the document anywhere. Specifically it is
too easy to get the user to reassign the pointer to malware. It is easy to get users to do this in my experience, so security considerations are warranted. I did not yet file an issue to see if anyone agreed with me, and then I would do it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:black;background:rgb(242,242,242)">Let's not lead the user into danger.
</span>..tom<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 14, 2023 at 10:39 AM Andrii Deinega via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><a href="https://mailarchive.ietf.org/arch/msg/oauth/9DdkE2P0RrUZMeZAbdf3NrMfy0w/" target="_blank">https://mailarchive.ietf.org/arch/msg/oauth/9DdkE2P0RrUZMeZAbdf3NrMfy0w/</a> is a link to a discussion on the "pragma" response header in
OAuth 2 WG.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Andrii<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 14, 2023 at 10:23 AM Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hi Michael,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Two very minor things.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">1. The pragma HTTP response header can be removed from all examples from all specs. Take a look at an old discussion in the OAuth 2 WG. OAuth 2.1 spec does not have any references to it either.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2. The no-store is the strongest cache directive and it already includes no-cache. Hence, the use of "Cache-Control: no-store" in all examples should be enough.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Andrii<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Sun, Aug 13, 2023 at 3:23 PM Michael Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">I’ve published drafts incorporating all the proposed errata corrections for the OpenID Connect family of specifications. This is a major step along the way both towards publishing
our second errata set for OpenID Connect and for submission to ISO as Publicly Available Specification (PAS) standards.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The drafts incorporating the errata corrections are:<u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-core-1_0-32.html" target="_blank">https://openid.net/specs/openid-connect-core-1_0-32.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-discovery-1_0-35.html" target="_blank">https://openid.net/specs/openid-connect-discovery-1_0-35.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-registration-1_0-37.html" target="_blank">https://openid.net/specs/openid-connect-registration-1_0-37.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-backchannel-1_0-11.html" target="_blank">https://openid.net/specs/openid-connect-backchannel-1_0-11.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The History sections of the specs describe each of the changes made. If you want to see the precise changes incorporated, I suggest using your favorite HTML-capable diff tool (such
as Microsoft Word) and comparing the baseline docs below to the ones above:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-core-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-core-1_0-errata1.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-discovery-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-discovery-1_0-errata1.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-registration-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-registration-1_0-errata1.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-backchannel-1_0-final.html" target="_blank">https://openid.net/specs/openid-connect-backchannel-1_0-final.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Diffs are also possible for the .txt and .xml versions of the specs; just substitute “html” in the URLs above for “txt” or “xml” and use your favorite diff tool.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I plan to ask for working group review of these changes during tomorrow’s working group call. Following the working group review, we’ll hold the foundation-wide 45-day proposed
errata review and then the approval vote.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">P.S. Our two Implementer’s Guides were also updated in parallel to keep them current with the versions incorporating errata corrections. The corresponding versions are:<u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-basic-1_0-44.html" target="_blank">https://openid.net/specs/openid-connect-basic-1_0-44.html</a><u></u><u></u></li><li class="MsoNormal">
<a href="https://openid.net/specs/openid-connect-implicit-1_0-27.html" target="_blank">https://openid.net/specs/openid-connect-implicit-1_0-27.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</div></blockquote></div>