"At the end, I reached the conclusion that OAuth 2.0 is a bad protocol. WS-* bad. It is bad enough that I no longer want to be associated with it. It is the biggest professional disappointment of my career.”
- Eran Hammer, lead author and editor of OAuth 2.0 spec
"All the hard fought compromises on the mailing list, in meetings, in special design committees, and in back channels resulted in a specification that fails to deliver its two main goals – security and interoperability."
- Eran Hammer, lead author and editor of OAuth 2.0 spec
In the age of people trying AI for everything and occasionally following instructions the trustworthiness they cannot judge, that's probably the biggest problem. From a security perspective, the lethal trifecta is alive and well.
A commercial customer will lock down their mcps (requiring approval by an admin), and there it may make sense to allow adding custom mcp servers. But for consumer accounts, not allowing arbitrary mcps is a conservative move. Though honestly given how the AI labs operate, it's surprising to me that they're not looser with restrictions in the name of more engagement.
Is it a prerequisite that a poisoned agent gives them the link in the current working session, so they think it's related to the session?
"At the end, I reached the conclusion that OAuth 2.0 is a bad protocol. WS-* bad. It is bad enough that I no longer want to be associated with it. It is the biggest professional disappointment of my career.”
"All the hard fought compromises on the mailing list, in meetings, in special design committees, and in back channels resulted in a specification that fails to deliver its two main goals – security and interoperability."> Eran Hammer, lead author and editor of OAuth 2.0 spec
I do not think this is a completely full characterization - he left the project over his criticisms of it and withdrew his name from all of it.
In the age of people trying AI for everything and occasionally following instructions the trustworthiness they cannot judge, that's probably the biggest problem. From a security perspective, the lethal trifecta is alive and well.
A commercial customer will lock down their mcps (requiring approval by an admin), and there it may make sense to allow adding custom mcp servers. But for consumer accounts, not allowing arbitrary mcps is a conservative move. Though honestly given how the AI labs operate, it's surprising to me that they're not looser with restrictions in the name of more engagement.