Subject: Re: [OAUTH-WG] 2nd Call for Adoption: Authentication Method Reference Values

From: Mike Schwartz <[email-masked]>
Date: Thu, 03 Mar 2016 08:57:47 -0800

OAuth Guru's,

I know you are all going to approve this AMR spec anyway, but I'd just 
like to dissent. I think this specification is useless, and potentially 
harmful.

Just as an example--two domains that use "face" as the amr probably have 
totally different algorithms, sensitivities, training, and identity 
management processes that contribute to the significance of this value. 
So rather than interoperability, this standard just sets up domains for 
miscommunication.

If it doesn't serve interoperabilty, what use case does this standard 
solve?

I think a bad quick and dirty solution is worse than no solution at all. 
If I had a vote, I'd definitely vote against this one.

- Mike

-------------------------------------
Michael Schwartz
Gluu
Founder / CEO

---

From: John Bradley <[email-masked]>
Date: Thu, 3 Mar 2016 14:52:17 -0300

Mike if you subscribe to the mailing list your opinion counts towards consensus.   I am sure you are well aware that the IETF doesn’t vote in WG.

Do you object to the specific initial values in the registry or the notion of having a IANA registry for the values.

You are also free to contribute text to the authors or the WG if it is accepted as a work item.

The question at this point is if it should this draft be the starting point for a work item in the Working group.

We are a long way from approving a spec to go to the IESG for review.

John B.

> On Mar 3, 2016, at 1:57 PM, Mike Schwartz <[email-masked]> wrote:
> 
> OAuth Guru's,
> 
> I know you are all going to approve this AMR spec anyway, but I'd just like to dissent. I think this specification is useless, and potentially harmful.
> 
> Just as an example--two domains that use "face" as the amr probably have totally different algorithms, sensitivities, training, and identity management processes that contribute to the significance of this value. So rather than interoperability, this standard just sets up domains for miscommunication.
> 
> If it doesn't serve interoperabilty, what use case does this standard solve?
> 
> I think a bad quick and dirty solution is worse than no solution at all. If I had a vote, I'd definitely vote against this one.
> 
> - Mike
> 
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth