December 2024 - Wg-pemc - mailman.kantarainitiative.org

Re: [OAUTH-WG] Alternative text for sd-jwt privacy considerations.
by Tom Jones 02 Jan '25

02 Jan '25

I am appalled! All humans must adapt to the consent plans of this small standards group! I for one do not plan to adapt - sorry about that! Peace ..tom jones On Thu, Dec 26, 2024 at 4:15 PM David Waite <david(a)alkaline-solutions.com> wrote: > > > > On Dec 26, 2024, at 10:38 AM, Tom Jones <thomasclinganjones(a)gmail.com> > wrote: > > > > This problem was clearly demonstrated by the California mDL hackathon > where the default presentation was ALL DATA. That is the easiest path, so > it remains the one most taken. We have known since standards were first > introduced that they immediately create a drive to the bottom. This will be > the fate of this standard as well. The most permissive interpretation will > be the most common. The user's desires will not be met. > > > > The consequence of splitting out the policy for controlling data release > from the issuing authority is that the complexity that was the business > logic for handling requests, determining if they are appropriate for the > use case, prompting the user for consent, etc. is now all complexity pushed > into the (likely third party) user agent. > > Architectures like PRIVACYPASS create individual solutions to release a > particular type of information in the most privacy-preserving manner they > are capable of. This sort of business logic is baked into the protocol, and > the scope of implementation is thus boxed to solve that particular problem. > The user agent can only work per the spec if it intends to work properly, > and following the specification (hopefully) leads to a complete > implementation. > > The majority of verifiable credentials systems proposed have no such > bounds - which is one reason you are likely to see credentials often scoped > to be issued only to specific, qualified wallets in production. Those > specific user agents will enforce the required security and privacy > requirements the issuer has for their credential. That is both their own > policy logic to be enforced (such as a credential being bound to hardware), > as well as their own requirements for appropriate user behavior (such as > mandatory authentication and mandatory disclosure before the credential is > released). That could include verifier authentication and having the holder > agent confirm the verifier is authorized by the issuer to make the sort of > request they are making - before a user consent prompt ever enters the > picture. > > You could say that the captcha usage of privacy pass and AAMVA mDL usage > are the same in that they develop trust frameworks that define the network > of acceptable participants. I suspect however that the requirements for the > latter contain significantly more requirements and potentially new > technical works. > > A mDL hackathon has likely not set such policy or mandated that mDL and > readers abide by it. They may not even have wanted to limit participants to > having support for specifying complex queries (especially with the > OpenID4VP query language changes which occurred recently). I’m not > surprised a hackathon defaulted to a wide-open attribute policy. > > -DW

4 3

Have to cancel PEMC
by John Wunderlich 11 Dec '24

11 Dec '24

Have been dealing with a minor health issue. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

the current draft does not actually discuss privacy enhancing technologies
by Tom Jones 09 Dec '24

09 Dec '24

Was that omission intentional? The british pound is addressing them https://dci.mit.edu/enhancing-the-privacy-of-a-digital-pound Should we? "This paper offers a primer on three PETs. We consider how PETs such as pseudonymization, zero-knowledge proofs (ZKPs), and several multiparty functionalities (such as Secure Multiparty Computation) might be applied to a potential digital pound platform. In particular, we assess design options and trade-offs that may exist for each PET, how these PETs could be applied in a hypothetical digital currency system, compatible with the Bank of England’s proposal for a digital pound, and whether these PETs might help safeguard users’ privacy in a digital pound while adhering to regulations related to anti-money laundering (AML) and countering the financing of terrorism (CFT)." Peace ..tom jones

1 0

Fw: Reminder: IEC Academy ISO/IEC Artificial Intelligence: 6th Workshop starts in 1 day
by Salvatore D'Agostino 08 Dec '24

08 Dec '24

FYI Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: IEC ACADEMY <no-reply(a)zoom.us> Sent: Sunday, December 8, 2024 12:13 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Reminder: IEC Academy ISO/IEC Artificial Intelligence: 6th Workshop starts in 1 day [http://iec.zoom.us/w_p/98549939714/f6a2fca2-0118-40f6-ba73-ff8d3ed5db5a.jpg] Hi Salvatore D’Agostino, This is a reminder that your webinar will begin in 1 day: ISO/IEC Artificial Intelligence: 6th Workshop Date & Time Dec 9, 2024 09:00 AM Pacific Time (US and Canada) Webinar ID 985 4993 9714 Passcode 632724 Description The 6th ISO/IEC Artificial Intelligence Workshop will be held on: December 9th - 0900 to 1400 (Pacific Time) and December 11th - 0900 to 1400 (Pacific Time) Thematic tracks: Session 1: December 9th 0900 – 1400 Pacific Overview of SC 42 > AI Applications Roundtable – How AI is Revolutionizing Transportation > Beneficial AI – AI and Sustainability Session 2: December 11th 0900 – 1400 Pacific > Emerging Tech Trends and Requirements > Novel AI Standardization Approaches More information, including slides and recordings from previous events, is available on the JTC1 website: https://jtc1info.org/technology/subcommittees/ai/workshops/ Add to: [https://st3.zoom.us/static/6.3.28445/image/new/google.png]<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/calendar/g…> Google Calendar<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/calendar/g…> <https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/calendar/g…> [https://st3.zoom.us/static/6.3.28445/image/new/outlook.png]<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/ics?user_i…> Outlook Calendar(.ICS)<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/ics?user_i…> <https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/ics?user_i…> [https://st3.zoom.us/static/6.3.28445/image/new/yahoo.png]<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/ics?user_i…> Yahoo Calendar<https://iec.zoom.us/webinar/tJwoc-ChrTItG9AIwr0X34WZea56Ws36yvXB/ics?user_i…> You can cancel<https://iec.zoom.us/webinar/register/WN_nJflkkbTSR-XHNZuFGWhSA?tk=1pj3gAVXz…> your registration at any time. Please submit any questions to: academy(a)iec.ch Thank you! WAYS TO JOIN THIS WEBINAR * Join from PC, Mac, iPad, or Android Join Webinar <https://iec.zoom.us/w/98549939714?tk=1pj3gAVXzCzsFiU-_SgIodRknVxVMSux-gUwYu…> If the button above does not work, paste this into your browser: https://iec.zoom.us/w/98549939714?tk=1pj3gAVXzCzsFiU-_SgIodRknVxVMSux-gUwYu… To keep this webinar secure, do not share this link publicly. * Join via audio Or, dial: US: +1 309 205 3325 or +1 312 626 6799 or +1 346 248 7799 or +1 360 209 5623 or +1 386 347 5053 or +1 408 638 0968 or +1 507 473 4847 or +1 564 217 2000 or +1 646 876 9923 or +1 646 931 3860 or +1 669 444 9171 or +1 669 900 6833 or +1 689 278 1000 or +1 719 359 4580 or +1 253 205 0468 or +1 253 215 8782 or +1 301 715 8592 or +1 305 224 1968 Argentina: +54 341 512 2188 or +54 343 414 5986 or +54 112 040 0447 or +54 115 983 6950 Austria: +43 12 535 501 or +43 12 535 502 or +43 670 309 0165 or +43 72 011 5988 or +43 120 609 3072 Australia: +61 3 7018 2005 or +61 7 3185 3730 or +61 8 6119 3900 or +61 8 7150 1149 or +61 2 8015 6011 Brazil: +55 11 4632 2237 or +55 11 4680 6788 or +55 11 4700 9668 or +55 21 3958 7888 or +55 11 4632 2236 Bulgaria: +359 2 492 5688 or +359 3 257 1633 Belgium: +32 2 788 0172 or +32 2 788 0173 or +32 1579 5132 or +32 2 290 9360 or +32 2 585 5574 or +32 2 588 4188 Estonia: +372 660 1699 or +372 880 1188 El Salvador: +503 2113 9088 or +503 2136 6444 Dominican Republic: +1 829 947 9220 or +1 829 956 2188 Denmark: +45 47 37 25 75 or +45 89 88 37 88 or +45 32 70 12 06 or +45 32 71 31 57 or +45 32 72 80 10 or +45 32 72 80 11 Czech Republic: +420 2 3901 8272 or +420 5 3889 0161 or +420 2 2888 2388 Cyprus: +357 2 200 0888 or +357 2 505 4777 Croatia: +385 1300 0988 or +385 1777 6333 Colombia: +57 60 1514 0382 or +57 60 1518 9697 or +57 60 1518 9698 or +57 60 2620 7388 or +57 60 1508 7702 Chile: +56 22 573 9305 or +56 23 210 9066 or +56 232 938 848 or +56 41 256 0288 or +56 22 573 9304 Canada: +1 778 907 2071 or +1 780 666 0144 or +1 204 272 7920 or +1 438 809 7799 or +1 587 328 1099 or +1 647 374 4685 or +1 647 558 0588 Greece: +30 211 198 4488 or +30 231 118 0599 Germany: +49 695 050 2596 or +49 69 7104 9922 or +49 69 3807 9883 or +49 69 3807 9884 or +49 69 5050 0951 or +49 69 5050 0952 Hong Kong SAR: +852 5803 3731 or +852 5808 6088 or +852 3012 6283 or +852 5803 3730 Hungary: +36 1 701 0488 or +36 1 779 9126 or +36 1 408 8456 Ireland: +353 1 653 3898 or +353 6 163 9031 or +353 1 240 8941 or +353 1 536 9320 or +353 1 653 3895 or +353 1 653 3897 Israel: +972 2 376 4510 or +972 3 978 6688 or +972 2 376 4509 Italy: +39 021 241 28 823 or +39 069 480 6488 or +39 020 066 7245 Japan: +81 3 4578 1488 or +81 3 4579 0432 or +81 3 4579 0545 or +81 363 628 317 or +81 342 339 271 Latvia: +371 6303 1808 or +371 6303 1888 Luxembourg: +352 2786 4277 or +352 342 080 9265 or +352 2786 1188 Lithuania: +370 3799 9260 or +370 5214 1488 Mexico: +52 554 169 6926 or +52 556 826 9800 or +52 558 659 6001 or +52 558 659 6002 or +52 554 161 4288 Netherlands: +31 20 794 7345 or +31 707 006 526 or +31 20 241 0288 or +31 20 794 0854 or +31 20 794 6519 or +31 20 794 6520 Norway: +47 2400 4735 or +47 2400 4736 New Zealand: +64 4 886 0026 or +64 9 884 6780 or +64 3 659 0603 Panama: +507 378 2155 or +507 833 9588 Peru: +51 1 708 8312 or +51 1 730 6777 or +51 1 707 5788 Poland: +48 22 307 3488 or +48 22 398 7356 or +48 22 306 5342 Portugal: +351 308 804 188 or +351 308 810 988 or +351 211 202 618 Puerto Rico: +1 787 966 7727 or +1 939 945 0244 or +1 787 945 1488 Romania: +40 31 630 1088 or +40 37 170 0418 Russia: +7 499 951 6379 or +7 499 951 6380 or +7 499 281 6510 or +7 499 281 6543 Singapore: +65 3158 7288 or +65 3165 1065 or +65 3129 4891 or +65 3129 4892 Slovakia: +421 233 056 888 or +421 233 418 515 Slovenia: +386 1600 3102 or +386 1888 8788 South Africa: +27 87 550 3946 or +27 87 551 7702 or +27 21 426 8190 or +27 21 426 8191 Korea, Republic of: +82 2 3143 9611 or +82 2 3143 9612 Spain: +34 91 787 0058 or +34 917 873 431 or +34 84 368 5025 Sweden: +46 8 5052 0017 or +46 850 539 728 or +46 8 4468 2488 or +46 8 5016 3827 or +46 8 5050 0828 or +46 8 5050 0829 Switzerland: +41 43 210 71 08 or +41 44 529 92 72 or +41 22 591 00 05 or +41 22 591 01 56 or +41 31 528 09 88 or +41 43 210 70 42 United Kingdom: +44 208 080 6592 or +44 330 088 5830 or +44 131 460 1196 or +44 203 481 5237 or +44 203 481 5240 or +44 203 901 7895 or +44 208 080 6591 Malaysia: +60 3 7724 4079 or +60 3 7724 4080 or +60 3 2706 0888 or +60 3 2706 0889 Malta: +356 2776 1777 or +356 2778 1288 Georgia: +995 3224 73988 or +995 7067 77954 France: +33 1 7037 9729 or +33 1 7095 0103 or +33 1 7095 0350 or +33 1 8699 5831 or +33 1 7037 2246 Finland: +358 9 4245 1488 or +358 9 7252 2471 or +358 3 4109 2129 More International numbers<https://iec.zoom.us/u/aetmlJueO> Webinar ID: 985 4993 9714 Passcode: 632724 [https://st3.zoom.us/static/6.3.28445/image/new/twitter.png]<https://twitter.com/zoom> [https://st3.zoom.us/static/6.3.28445/image/new/linkedin.png] <https://www.linkedin.com/company/zoom/> [https://st3.zoom.us/static/6.3.28445/image/new/zoomblog.png] <https://blog.zoom.us/> +1.888.799.9666<tel:1-888-799-9666> Copyright ©2024 Zoom Video Communications, Inc. Visit Zoom.us<http://zoom.us> 55 Almaden Blvd<https://www.google.com/maps/place/55+Almaden+Blvd,+San+Jose,+CA+95113/@37.3…> San Jose, CA 95113<https://www.google.com/maps/place/55+Almaden+Blvd,+San+Jose,+CA+95113/@37.3…> [https://st3.zoom.us/static/6.3.28445/image/new/ZoomLogo3.png]<https://zoom.us>

1 0

FW: Certificate usage
by Salvatore D'Agostino 06 Dec '24

06 Dec '24

Yes, interesting, passing along. Thanks Dan. Building on TLS 1.3 for client/server makes a lot of sense. Here is the technical article referenced in the blog post. 1063.pdf<https://eprint.iacr.org/2023/1063.pdf> The record layer effectively uses a receipt. From: Daniel Schleifer <dan(a)idmachines.com> Sent: Friday, December 6, 2024 1:00 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Certificate usage Hi Sal, I saw this article and thought it was interesting. https://brave.com/blog/distefano/

3 4

(2) Notice and Choice Cannot Stand Alone | LinkedIn
by John Wunderlich 05 Dec '24

05 Dec '24

https://www.linkedin.com/pulse/notice-choice-cannot-stand-alone-association… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Is this telling us that aamva & ausroada are collaborating on trust?
by Tom Jones 04 Dec '24

04 Dec '24

https://austroads.gov.au/latest-news/austroads-digital-trust-service-positi… thx ..Tom (mobile)

1 0

Cancelling tomorrow’s call
by John Wunderlich 03 Dec '24

03 Dec '24

No-one objected when I proposed cancelling tomorrow to catch up on comments and to allow for the absence of members at ISO meetings. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0