Subject: [saag] tram draft - anyone willing to help out?

From: Stephen Farrell <[email-masked]>
Date: Fri, 06 Mar 2015 15:43:57 +0000

Hiya,

There's a draft in IESG eval that attracted a bunch of perhaps
fundamental discusses and comments [1] about its security
properties. I think this may be one where the authors could
do with a bit more help from the security mafia^H^H^H^H^Hcommunity.
(I looked at their wg list and only see a v. thin smattering of
names I'd recognise from this list.) So if you're willing and
have a little time, please let me know and/or get in touch
with the authors.

And btw - this might not seem so important but I'd worry it may
end up being a major source of system level vulnerabilities for
WebRTC deployments if we get it wrong and many sites don't deploy
usefully good security for this bit of the WebRTC story.

Thanks in advance,
S.

[1]
https://datatracker.ietf.org/doc/draft-ietf-tram-turn-third-party-authz/ballot/

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 06 Mar 2015 18:15:24 +0100

Maybe folks in the OAuth working group could help since the document
abstract talks about an OAuth 2.0 solution.

On 03/06/2015 04:43 PM, Stephen Farrell wrote:
> btw - this might not seem so important but I'd worry it may

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Sat, 7 Mar 2015 01:41:30 +0000

Hi Hannes,

This draft is already reviewed in OAuth WG sometime back by you
(https://www.ietf.org/mail-archive/web/oauth/current/msg13325.html).

Thanks and Regards,
-Tiru

> -----Original Message-----
> From: saag [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
> Sent: Friday, March 06, 2015 10:45 PM
> To: Stephen Farrell; [email-masked]
> Subject: Re: [saag] tram draft - anyone willing to help out?
> 
> > btw - this might not seem so important but I'd worry it may end up
> > being a major source of system level vulnerabilities for WebRTC
> > deployments if we get it wrong and many sites don't deploy usefully
> > good security for this bit of the WebRTC story.