attachment
<html class="apple-mail-supports-explicit-dark-mode">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
As you all know, I’m not a cryptographer, but I really can’t imagine how this solution would actually be robust enough to be considered secure. If the file is hosted outside of the device, what prevents the URL from being provided by a device illegitimately?
<div><br id="lineBreakAtBeginningOfSignature">
<div dir="ltr">
<div><span style="background-color: rgba(255, 255, 255, 0);">Smith</span></div>
<div><span style="background-color: rgba(255, 255, 255, 0);"><br>
</span></div>
<div><span style="background-color: rgba(255, 255, 255, 0);">———————</span></div>
<div>
<div dir="ltr"><span style="background-color: rgba(255, 255, 255, 0);">Smith Kennedy</span>
<div><span style="background-color: rgba(255, 255, 255, 0);">smith.kennedy@hp.com</span></div>
</div>
</div>
</div>
<div dir="ltr"><br>
<blockquote type="cite">On Oct 11, 2025, at 9:31 AM, Michael Sweet via ipp <ipp@pwg.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"> <font face="" calibri??=""><b><span style="font-size:11.0pt;line-height:107%; color:red">CAUTION: External Email
</span></b></font>
<div>All,
<div><br>
</div>
<div>This is a new "solution" to client registration... I personally hope to see support for so-called "native" applications but right now (like most OAuth RFCs) very little is required...</div>
<div><br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>Begin forwarded message:</div>
<br class="Apple-interchange-newline">
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>From:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">"Lombardo, Jeff" <jeffsec=40amazon.com@dmarc.ietf.org><br>
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Subject:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;"><b>[OAUTH-WG] Re: I-D Action: draft-ietf-oauth-client-id-metadata-document-00.txt</b><br>
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Date:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">October 8, 2025 at 2:52:34 PM EDT<br>
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>To:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">"oauth@ietf.org" <oauth@ietf.org>, "i-d-announce@ietf.org" <i-d-announce@ietf.org><br>
</span></div>
<br>
<div>
<div>Having done a review recently and looking at implementing it, I support adoption.<br>
<br>
Jean-François “Jeff” Lombardo | Amazon Web Services<br>
<br>
Architecte Principal de Solutions, Spécialiste de Sécurité<br>
Principal Solution Architect, Security Specialist<br>
Montréal, Canada<br>
<br>
Commentaires à propos de notre échange? Exprimez-vous ici.<br>
<br>
Thoughts on our interaction? Provide feedback here.<br>
<br>
-----Original Message-----<br>
From: internet-drafts@ietf.org <internet-drafts@ietf.org> <br>
Sent: October 8, 2025 2:48 PM<br>
To: i-d-announce@ietf.org<br>
Cc: oauth@ietf.org<br>
Subject: [EXT] [OAUTH-WG] I-D Action: draft-ietf-oauth-client-id-metadata-document-00.txt<br>
<br>
CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.<br>
<br>
<br>
<br>
AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque.<br>
<br>
<br>
<br>
Internet-Draft draft-ietf-oauth-client-id-metadata-document-00.txt is now available. It is a work item of the Web Authorization Protocol (OAUTH) WG of the IETF.<br>
<br>
Title: OAuth Client ID Metadata Document<br>
Authors: Aaron Parecki<br>
Emelia Smith<br>
Name: draft-ietf-oauth-client-id-metadata-document-00.txt<br>
Pages: 12<br>
Dates: 2025-10-08<br>
<br>
Abstract:<br>
<br>
This specification defines a mechanism through which an OAuth client<br>
can identify itself to authorization servers, without prior dynamic<br>
client registration or other existing registration. This is through<br>
the usage of a URL as a client_id in an OAuth flow, where the URL<br>
refers to a document containing the necessary client metadata,<br>
enabling the authorization server to fetch the metadata about the<br>
client as needed.<br>
<br>
The IETF datatracker status page for this Internet-Draft is:<br>
<a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/">https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/</a><br>
<br>
There is also an HTML version available at:<br>
<a href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html">https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html</a><br>
<br>
Internet-Drafts are also available by rsync at:<br>
rsync.ietf.org::internet-drafts<br>
<br>
<br>
_______________________________________________<br>
OAuth mailing list -- oauth@ietf.org<br>
To unsubscribe send an email to oauth-leave@ietf.org<br>
_______________________________________________<br>
OAuth mailing list -- oauth@ietf.org<br>
To unsubscribe send an email to oauth-leave@ietf.org<br>
</div>
</div>
</blockquote>
</div>
<br>
<div>
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
________________________<br>
Michael Sweet<br>
</div>
</div>
<br>
</div>
</div>
<span>_______________________________________________</span><br>
<span>ipp mailing list</span><br>
<span>ipp@pwg.org</span><br>
<span>https://www.pwg.org/mailman/listinfo/ipp</span><br>
</div>
</blockquote>
</div>
</body>
</html>