Why Protocols Fail to Transition to Mobile Domains

Applying protocols to new settings for which they were not originally designed can result in failures and vulnerabilities. This problem becomes particularly severe when security protocols are concerned. As more and more novel technologies such as IoT are being put into practical use, the study of the above mentioned problems gains an increasing importance. This paper investigates the issues which arise when transitioning the OAuth protocol to the mobile phone setting. First, we informally discuss the issues arising during such transitioning. Then, we revist the formal analysis of the OAuth protocol presented by Fett et al. at ACM CCS 2017 [1], pinpointing the issues that may lead to vulnerabilities in the mobile scenario.