5

While using the twitter API, I came across the oauth_signature which is basically a hash of the (request body + request parameters + nonces/timestamps + a consumer_secret). The consumer_secret is known only to the application that is sending the request.

In Twitter's case:

  • all communication MUST happen over SSL.
  • twitter issues the consumer_secret to each authorized application.

Since the primary use of the oauth_signature is to prevent MITMs (i.e. no tits (tampering in transit) :), it seems to me that this particular use case could be solved via Mutual SSL

  • Twitter, instead of issuing the consumer_secret, can issue SSL certificates for each application.

While this idea of client ssl-certificates might seem like 1990s internet arcana, it was not successful largely because of the trouble in verifying the chain of trust for client certificates. That problem does not arise here because twitter would be the sole issuer AND verifier of the certificates. The drawback would be much more involved effort on Twitter's behalf to produce the initial application/client ssl certificates, but the payoff would be in the simplicity of the REST API, which can rest on the guarantee that the client is who he says he is.

Note that twitter is just an example in this case. AFAIK, most other oauth implementors use a similar strategy, and the points here apply to any large scale OAuth implementor that already mandates SSL.

What am I missing here? Internet Inertia?

Manav
  • 10,094
  • 6
  • 44
  • 51

1 Answers1

-1

Mutual SSL certs, while a good idea, don't exactly solve the problem that OAuth is trying to solve. OAuth has two sets of tokens. One for the application (which could be replaced by the SSL certs), but also for the specific user. The SSL certs don't help when you are trying to determine if this authorized application is allowed to access this specific user.

Mark S.
  • 3,849
  • 4
  • 20
  • 22
  • You're missing the question. I am not saying that mutual-SSL-certs will solve the problem that OAuth solve. I am saying that the `oauth_signature` mechanism is basically reinventing the two way authentication that mutual-SSL-certs already provide. – Manav Sep 08 '12 at 04:44
  • 1
    But the mutual SSL Certs only solve half the problem (the application token side) and do nothing for the consumer token side. And if you look at OAuth 2.0, they've moved in that direction. – Mark S. Sep 08 '12 at 06:40