<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Some API may have standardized scopes. If you have multiple places that support the same API you wind up trying to create structured scope names again.<div>Also in the case of asking for a id_token to be used at a downstream AS you need to specify an audience for that token.</div><div><br></div><div>In a tightly controlled enterprise perhaps overloading scope will work, but once you allow any sort of federation I think you need to separate the resource provider from the permissions.</div><div><br></div><div>We are having to do that for proof of possession tokens in OAuth anyway, as scope is not specific enough for the AS to know what keying material to use without inventing structured scopes.</div><div><br></div><div>John B.</div><div><br><div><div>On Oct 6, 2014, at 5:14 AM, Emily Xu <<a href="mailto:exu@vmware.com">exu@vmware.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>Is it reasonable to assume that we agree that we need some kind of mechanism to identify an application? We can call it app identifier, azp, or something else. Its value is to be specified. In the minimum, we could use iOS bundle_id or Android package
name as its value because this is something that a TA could verify.</div>
<div><br>
</div>
<div>Also, do we agree that we could move app identifier out of scope parameter? By doing so, scope can be used to identify token scope therefore there would be no need for the default_scope parameter.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Emily</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold">From: </span>William Denniss <<a href="mailto:wdenniss@google.com">wdenniss@google.com</a>><br>
<span style="font-weight:bold">Date: </span>Friday, August 8, 2014 2:07 PM<br>
<span style="font-weight:bold">To: </span>Mike Varley <<a href="mailto:mike.varley@securekey.com">mike.varley@securekey.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>" <<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-native-apps] Identifying applications.<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>I think we can rely on the OS-level assertions to a certain extent – Bundle ID on iOS, Package Name + Signature on Android. Google does this today in its OAuth for Installed Applications implementation.</div>
<div><br>
</div>
<div>John's point about an attacker potentially being able to upload an app with a bundle-id matching an enterprise app to the App store is valid. To counter that, it may be recommended for the enterprise to create a normal Developer Account (~$100/yr) just
to register the bundle ID (enterprise accounts don't have this functionality it <a href="https://urldefense.proofpoint.com/v1/url?u=http://stackoverflow.com/a/8879763/72176&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=JgtwqYPnJDh1Lz6okAsTOj4ursW3h5fdLL4h2jq4jpw%3D%0A&s=b9fcebcc3c63d80448de7ea9643ff94eea849362d634de44ba522664f99a2d54" target="_blank">seems</a>).
In general I'd say it's fairly safe even without doing that – for the attack to work, you'd have to get through Apple's review process, and still convince the user to download & use the app.</div>
<div><br>
</div>
<div class="gmail_extra">William</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Aug 8, 2014 at 6:24 AM, Mike Varley <span dir="ltr">
<<a href="mailto:mike.varley@securekey.com" target="_blank">mike.varley@securekey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word">Verifying an App identity on any given mobile platform seems to be a challenge - should the spec define its own mechanism for verifying an App identity? or is that too much scope creep?
<div><br>
</div>
<div>(something like the proof-of-possession spec for OAuth 2.0…)</div>
<div><br>
</div>
<div>MV<br>
<div><br>
</div>
<div><br>
</div>
<div><br>
<div>
<div>
<div>
<div>On Aug 7, 2014, at 2:46 PM, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>> wrote:</div>
<br>
</div>
</div>
<blockquote type="cite">
<div>
<div>
<div style="word-wrap:break-word">
<div><br>
<div>
<div style="word-wrap:break-word">Hi William,
<div><br>
</div>
<div><br>
</div>
<div>Thanks that is useful information.</div>
<div><br>
</div>
<div>My concern is that a large user of this may be enterprises. </div>
<div>A enterprise creating app x for there enterprise store might be subverted by a app in a public store.</div>
<div><br>
</div>
<div>I can see an attacker sending a email link to an employee at company x saying down load this one time free app, that impersonates the app name of some internal HR or finance application.</div>
<div><br>
</div>
<div>It will at minimum need to be a security consideration, I think.</div>
<div><br>
</div>
<div><br>
</div>
<div>Regards</div>
<div>John B.</div>
<div><br>
</div>
<div>
<div>
<div>On Aug 6, 2014, at 8:58 PM, William Denniss <<a href="mailto:wdenniss@google.com" target="_blank">wdenniss@google.com</a>> wrote:</div>
<br>
<blockquote type="cite">
<div dir="ltr">
<div>On Wed, Aug 6, 2014 at 4:15 PM, John Bradley <span dir="ltr"><<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>></span> wrote:<br>
</div>
<div>
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Can people comment on what needs to be passed to uniquely identify an app on iOS , Android and Windows mobile.<br>
</blockquote>
<div><br>
</div>
For iOS it is the bundle identifier. These are globally unique within the Apple ecosystem. I verified this by attempting to create a new app using a known bundle identifier of another app, and got the error: "The Bundle ID you entered has already been used.".
<div><br>
</div>
<div>The bundle identifier is passed by the OS during inter-app communication in the <a href="https://urldefense.proofpoint.com/v1/url?u=https://developer.apple.com/library/ios/documentation/uikit/reference/UIApplicationDelegate_Protocol/Reference/Reference.html%23//apple_ref/occ/intfm/UIApplicationDelegate/application:openURL:sourceApplication:annotation:&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=JgtwqYPnJDh1Lz6okAsTOj4ursW3h5fdLL4h2jq4jpw%3D%0A&s=4803172c5cc6945c87a2e78cbe447eff72e89091948bcba9bfecd161f621eeae" target="_blank">UIApplicationDelegate/application:openURL:sourceApplication:annotation:</a>
method which can be used to restrict which apps you interact with. This has applications similar to whitelisting javascript origins and redirect URIs.</div>
<div><br>
</div>
<div>On Android, the package name – very similar in concept to the iOS bundle identifier – is also globally unique (<a href="https://urldefense.proofpoint.com/v1/url?u=http://developer.android.com/guide/topics/manifest/manifest-element.html%23package&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=JgtwqYPnJDh1Lz6okAsTOj4ursW3h5fdLL4h2jq4jpw%3D%0A&s=804445de26d9997902160280f7df552df19d6b35543a6f6417791550c9c63134" target="_blank">docs</a>).
Two apps on the Play Store cannot have the same package name.</div>
<div><br>
</div>
<div>As Android allows apps from unknown sources, the OS level assertion of the bundle identifier is less authoritative than on iOS, which is why it may be advisable to also verify the application signature. It is theoretically possible to distribute an iOS
app with a conflicting bundle identifier, but it would have to be distributed outside the App Store which is hard (Enterprise, AdHoc or development builds – none which can achieve wide distribution).</div>
<div><br>
</div>
<div>William</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net" target="_blank">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v1/url?u=http://lists.openid.net/mailman/listinfo/openid-specs-native-apps&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=JgtwqYPnJDh1Lz6okAsTOj4ursW3h5fdLL4h2jq4jpw%3D%0A&s=d35d90f7cdcb9e3c8f0c2390a613664285b6db3c671c43a81f8f3437e72da443" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
<br>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net" target="_blank">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v1/url?u=http://lists.openid.net/mailman/listinfo/openid-specs-native-apps&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=JgtwqYPnJDh1Lz6okAsTOj4ursW3h5fdLL4h2jq4jpw%3D%0A&s=d35d90f7cdcb9e3c8f0c2390a613664285b6db3c671c43a81f8f3437e72da443" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</span>
</div>
_______________________________________________<br>Openid-specs-native-apps mailing list<br><a href="mailto:Openid-specs-native-apps@lists.openid.net">Openid-specs-native-apps@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-native-apps<br></blockquote></div><br></div></body></html>