draft-ietf-oauth-cross-device-security-12

Fixed references to point to final versions of specifications

What's Changed

• Fixed FIDO CTAP V2.2 URL by @PieterKas in #178
• Update SSF Reference by @PieterKas in #179
• CAEP Reference Update by @PieterKas in #180
• Fix IEEE reference by @PieterKas in #177
• Update IEEE Reference by @PieterKas in #181

Full Changelog: draft-ietf-oauth-cross-device-security-11...draft-ietf-oauth-cross-device-security-12

draft-ietf-oauth-cross-device-security-11

Includes formatting and editorial changes to clarify existing text.

What's Changed

• Fixing Labels by @PieterKas in #170
• Editorial Updates - Issue 164 by @PieterKas in #171
• Devices not sharing a network by @PieterKas in #172
• Clarify authorization server role in establishing proximity by @PieterKas in #173
• Add Dan Moore to acknowledgement by @PieterKas in #175
• Authorization Server only mitigations by @PieterKas in #174

Full Changelog: draft-ietf-oauth-cross-device-security-10...draft-ietf-oauth-cross-device-security-11

draft-ietf-oauth-cross-device-security-10

Addresses shepherd feedback

• Shepherd feedback: Describe unauthenticated channel.
• Shepherd feedback: Separate normative and informative references.
• Shepherd feedback: Update FIDO/WebAuthn references

draft-ietf-oauth-cross-device-security-09

• Affiliation change to allow publication to Datatracker.
• No content changes - re-published to avoid expiry while waiting on shepherd review.

draft-ietf-oauth-cross-device-security-08

• Editorial updates.

draft-ietf-oauth-cross-device-security-07

Includes feedback from Working Group Last Call. Changes include:

1. Clarification of FIDO\WebAuthn section.
2. Updated langugage in section on FIDO to allow for use of FIDO keys on consumption devices.
3. Clarified origin of QR Code.
4. Editorial updates
5. Updated examples to be consistent.
6. Made diagram description clearer.
7. Added CTAP 2.2 Draft.
8. Added additional guidance on geolocation inaccuracies.
9. Added Roy Williams to acknowledgements
10. Clarified that authorization servers can detect
11. Consistent use of "smart TV"
12. Fixed references

draft-ietf-oauth-cross-device-security-06

Corrected typos

draft-ietf-oauth-cross-device-security-05

• Added section to provide actionable guidance to implementers on how to use this document.
• Expanded section on formal analysis to include completed research projects.
• Added reference to OpenID for Verifiable Presentations.

draft-ietf-oauth-cross-device-security-04

Corrected formatting issue that prevented the document history from displaying correctly.

draft-ietf-oauth-cross-device-security-03

• Introduced normative SHOULD, RECOMMENDED and MAY when applied to actions the Authorization Server, Resource Server or Client may implement.
• Added User Education as a standalone mitigation.
• Added Maryam Mehrnezhad, Marco Pernpruner and Giada Sciarretta to the contributors list.
• Added Request Binding with Out-of-Band Data as an additional mitigation (feedback received at OSW 2023)
• Adopted the OpenID Foundation terminology from [CIBA] and changed Initiating Device to Consumption Device
• Added Fake Helpdesk and Consent Request Overload examples (new variations of attacks observed in the wild)
• Replaced "Authenticated Flow" mitigation name with "Authenticate-then-Intitiate"
• Added Cross-Device Session Transfer pattern (feedback received at OSW 2023)

What's Changed

• Capitalise SHOULD, MAY and RECOMMENDED where appropriate by @PieterKas in #75
• Fix punctuation, typos and hyphenation by @marcopernpruner in #81
• Inconsistency on "Authorization Device" by @marcopernpruner in #83
• Added User Education as an explicit mitigations by @PieterKas in #88
• Additional UX mitigation by @PieterKas in #90
• Additional mitigation by @PieterKas in #91
• Added contributors by @PieterKas in #102
• Added Out-of-Band User Entered Data Mitigation by @PieterKas in #101
• Refined the trusted devices section. by @PieterKas in #103
• Changed Terminology from Initiating Device to Consumption Device by @PieterKas in #106
• Fix header level for Request Binding with Out-of-Band Data by @marcopernpruner in #108
• Added Fake Helpdesk attack example by @PieterKas in #110
• Added Example B.9 by @PieterKas in #109
• Adding support for session transfer by @PieterKas in #112
• Alternative name for Authenticated Flow by @PieterKas in #111
• Restructure User Experience mitigation by @marcopernpruner in #107
• Editorial changes in intro and concepts section by @danielfett in #114
• Additional editorial changes by @danielfett in #115
• Fix editorial issues by @marcopernpruner in #113

New Contributors

• @marcopernpruner made their first contribution in #81

Full Changelog: draft-ietf-oauth-cross-device-security-02...draft-ietf-oauth-cross-device-security-03