<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>My experience with PKI leads me to believe that the refresh problem with X.509 is much worse than with the OpenID docs.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there any venue where trust w/I the OpenID ecosystem is discussed? ..tom</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>thx ..tom</p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='border:none;padding:0in'><b>From: </b><a href="mailto:openid-specs-fapi@lists.openid.net">Nat Sakimura via Openid-specs-fapi</a><br><b>Sent: </b>Wednesday, May 3, 2017 10:36 AM<br><b>To: </b><a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a><br><b>Subject: </b>Re: [Openid-specs-fapi] Fwd: [OAUTH-WG] Call for Adoption: Mutual TLSProfiles for OAuth Clients</p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It is not about the trust.</p><p class=MsoNormal>It is about avoiding bearer tokens (client secret, access token, refresh </p><p class=MsoNormal>token)</p><p class=MsoNormal>but use a bound token.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>---</p><p class=MsoNormal>Nat Sakimura</p><p class=MsoNormal>Research Fellow, Nomura Research Institute</p><p class=MsoNormal>Chairman of the Board, OpenID Foundation</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 2017-05-04 01:13, Tom Jones via Openid-specs-fapi wrote:</p><p class=MsoNormal>> I have tried to understand how this standard would help provide trust</p><p class=MsoNormal>> between the client and the endpoint, but I just don't see it. I know</p><p class=MsoNormal>> that trust is needed, particularly in the case of dynamic</p><p class=MsoNormal>> registration, but this does not seem to help that in any obvious way.</p><p class=MsoNormal>> </p><p class=MsoNormal>> ..tomj</p><p class=MsoNormal>> </p><p class=MsoNormal>> On Thu, Apr 20, 2017 at 10:44 AM, John Bradley via Openid-specs-fapi</p><p class=MsoNormal>> <openid-specs-fapi@lists.openid.net> wrote:</p><p class=MsoNormal>> </p><p class=MsoNormal>>> It would help if others chime in on the OAuth mailing list to</p><p class=MsoNormal>>> request this be adopted.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> People saying they want to use it always helps focus people.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> Regards</p><p class=MsoNormal>>> John B.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> Begin forwarded message:</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> FROM: John Bradley <ve7jtb@ve7jtb.com></p><p class=MsoNormal>>> </p><p class=MsoNormal>>> SUBJECT: RE: [OAUTH-WG] CALL FOR ADOPTION: MUTUAL TLS PROFILES FOR</p><p class=MsoNormal>>> OAUTH CLIENTS</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> DATE: April 20, 2017 at 2:40:20 PM GMT-3</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> TO: Hannes Tschofenig <hannes.tschofenig@gmx.net></p><p class=MsoNormal>>> </p><p class=MsoNormal>>> CC: "oauth@ietf.org" <oauth@ietf.org></p><p class=MsoNormal>>> </p><p class=MsoNormal>>> I accept the adoption as a starting point.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> John B.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> On Apr 20, 2017, at 1:32 PM, Hannes Tschofenig</p><p class=MsoNormal>>> <hannes.tschofenig@gmx.net> wrote:</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> Hi all,</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> based on the strong support for this document at the Chicago IETF</p><p class=MsoNormal>>> meeting we are issuing a call for adoption of the "Mutual TLS</p><p class=MsoNormal>>> Profiles</p><p class=MsoNormal>>> for OAuth Clients" document, see</p><p class=MsoNormal>>> https://tools.ietf.org/html/draft-campbell-oauth-mtls-01 [1]</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> Please let us know by May 4th whether you accept / object to the</p><p class=MsoNormal>>> adoption of this document as a starting point for work in the OAuth</p><p class=MsoNormal>>> working group.</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> Ciao</p><p class=MsoNormal>>> Hannes & Rifaat</p><p class=MsoNormal>>> </p><p class=MsoNormal>>> _______________________________________________</p><p class=MsoNormal>>> OAuth mailing list</p><p class=MsoNormal>>> OAuth@ietf.org</p><p class=MsoNormal>>> https://www.ietf.org/mailman/listinfo/oauth [2]</p><p class=MsoNormal>> </p><p class=MsoNormal>> _______________________________________________</p><p class=MsoNormal>> Openid-specs-fapi mailing list</p><p class=MsoNormal>> Openid-specs-fapi@lists.openid.net</p><p class=MsoNormal>> http://lists.openid.net/mailman/listinfo/openid-specs-fapi [3]</p><p class=MsoNormal>> </p><p class=MsoNormal>> --</p><p class=MsoNormal>> </p><p class=MsoNormal>> ..tom</p><p class=MsoNormal>> </p><p class=MsoNormal>> Links:</p><p class=MsoNormal>> ------</p><p class=MsoNormal>> [1] https://tools.ietf.org/html/draft-campbell-oauth-mtls-01</p><p class=MsoNormal>> [2] https://www.ietf.org/mailman/listinfo/oauth</p><p class=MsoNormal>> [3] http://lists.openid.net/mailman/listinfo/openid-specs-fapi</p><p class=MsoNormal>> </p><p class=MsoNormal>> _______________________________________________</p><p class=MsoNormal>> Openid-specs-fapi mailing list</p><p class=MsoNormal>> Openid-specs-fapi@lists.openid.net</p><p class=MsoNormal>> http://lists.openid.net/mailman/listinfo/openid-specs-fapi</p><p class=MsoNormal>_______________________________________________</p><p class=MsoNormal>Openid-specs-fapi mailing list</p><p class=MsoNormal>Openid-specs-fapi@lists.openid.net</p><p class=MsoNormal>http://lists.openid.net/mailman/listinfo/openid-specs-fapi</p><p class=MsoNormal><o:p> </o:p></p></div></body></html>