[Openid-specs-fapi] Issue #508: Security goals requirements ("shalls") may need to be relaxed/reworded (openid/fapi)

[Nat]

New issue 508: Security goals requirements ("shalls") may need to be relaxed/reworded
https://bitbucket.org/openid/fapi/issues/508/security-goals-requirements-shalls-may

Nat Sakimura:

Currently, it goes like this: 

> FAPI 2.0 profiles shall ensure that **no attacker can access resources belonging to a user.**

This probably is unachievable because

* it is only a probabilistic thing after all; and 
* a spec cannot ensure bad implementation does not happen. 

Perhaps we can relax wording a bit like “attacker cannot access resources belonging to a user with a probability significantly better than negligible” instead of “no attacker can”. Maybe am I too pedantic? 

Also, instead of mandating a document, it might be better to just to define the security property like “Authentication” here and move the security goals to each specific document. This will make it possible to define “non-repudiation” within the security goals instead of having an independent clause later. 

‌