iwhd security

Mark McLoughlin markmc at redhat.com
Thu Sep 15 16:38:39 UTC 2011


On Thu, 2011-09-15 at 11:39 -0400, Bryan Kearney wrote:
> On 09/15/2011 11:30 AM, Jim Meyering wrote:
> > Mark McLoughlin wrote:
> > ...
> >> Here's what I managed to get from looking at Katello's usage of OAuth
> >> for similar purposes.
> >
> > Hi Mark,
> > Thanks for the survey and references.
> >
> >>   * Despite all the dire warnings of OAuth 1.0 being a terrible protocol,
> >>     that does appear to be what we're using:
> >>
> >>      http://tools.ietf.org/html/rfc5849
> >
> > Can anyone give us an ETA for a Katello update to OAuth 2.0?
> 
> 
> We seem to be ok with what we have in place now. What would drive the 
> change to 2.0?

I admit my comment was fairly flippant and based on not much more than
seeing "OAuth 1.0 is terrible! No-one should ever use it!" type comments
on twitter etc. I actually don't know much about either protocol.

It looks like most of the OAuth libraries we use only implement OAuth
1.0, so you're right Bryan ... we'd need a really good reason to do all
the work required to get to 2.0.

For iwhd, it looks like we could use the liboauth library which is
already in Fedora ... and this too only implements 1.0.

Cheers,
Mark.



More information about the iwhd-devel mailing list