January 2025 - Wg-pemc - mailman.kantarainitiative.org

Reminder: No PEMC call this week.
by John Wunderlich 15 Jan '25

15 Jan '25

BUT: Next week should be the meeting when we review the comment disposition and - hopefully - move it forward toward full membership vote. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

CA DMV Wallet & mDL Pilot - California DMV
by John Wunderlich 10 Jan '25

10 Jan '25

Has anyone in the WG direct experience with the CA mDL? https://www.dmv.ca.gov/portal/ca-dmv-wallet/ Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

PEMC Update
by John Wunderlich 08 Jan '25

08 Jan '25

At today’s meeting we renewed the charter and held the leadership votes. https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/791511041/2025-1-8+Me… We hope to circulate the requirements document next with the comment dispostion Next Meeting: Jan 22 Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Amazon mDL EUDI Paul Grassi event
by Salvatore D'Agostino 08 Jan '25

08 Jan '25

https://www.dock.io/live-event-amazon-paul-grassi?utm_campaign=Live+Panel+%… Best in 2025.. Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

4 3

Bill Introduced To Digitalize Pilot Certificates - AVweb
by John Wunderlich 03 Jan '25

03 Jan '25

Thanks to Marc Aronson for this one: https://www.avweb.com/aviation-news/bill-aims-to-digitalize-pilot-certifica… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: [OAUTH-WG] Alternative text for sd-jwt privacy considerations.
by Tom Jones 02 Jan '25

02 Jan '25

I am appalled! All humans must adapt to the consent plans of this small standards group! I for one do not plan to adapt - sorry about that! Peace ..tom jones On Thu, Dec 26, 2024 at 4:15 PM David Waite <david(a)alkaline-solutions.com> wrote: > > > > On Dec 26, 2024, at 10:38 AM, Tom Jones <thomasclinganjones(a)gmail.com> > wrote: > > > > This problem was clearly demonstrated by the California mDL hackathon > where the default presentation was ALL DATA. That is the easiest path, so > it remains the one most taken. We have known since standards were first > introduced that they immediately create a drive to the bottom. This will be > the fate of this standard as well. The most permissive interpretation will > be the most common. The user's desires will not be met. > > > > The consequence of splitting out the policy for controlling data release > from the issuing authority is that the complexity that was the business > logic for handling requests, determining if they are appropriate for the > use case, prompting the user for consent, etc. is now all complexity pushed > into the (likely third party) user agent. > > Architectures like PRIVACYPASS create individual solutions to release a > particular type of information in the most privacy-preserving manner they > are capable of. This sort of business logic is baked into the protocol, and > the scope of implementation is thus boxed to solve that particular problem. > The user agent can only work per the spec if it intends to work properly, > and following the specification (hopefully) leads to a complete > implementation. > > The majority of verifiable credentials systems proposed have no such > bounds - which is one reason you are likely to see credentials often scoped > to be issued only to specific, qualified wallets in production. Those > specific user agents will enforce the required security and privacy > requirements the issuer has for their credential. That is both their own > policy logic to be enforced (such as a credential being bound to hardware), > as well as their own requirements for appropriate user behavior (such as > mandatory authentication and mandatory disclosure before the credential is > released). That could include verifier authentication and having the holder > agent confirm the verifier is authorized by the issuer to make the sort of > request they are making - before a user consent prompt ever enters the > picture. > > You could say that the captcha usage of privacy pass and AAMVA mDL usage > are the same in that they develop trust frameworks that define the network > of acceptable participants. I suspect however that the requirements for the > latter contain significantly more requirements and potentially new > technical works. > > A mDL hackathon has likely not set such policy or mandated that mDL and > readers abide by it. They may not even have wanted to limit participants to > having support for specifying complex queries (especially with the > OpenID4VP query language changes which occurred recently). I’m not > surprised a hackathon defaulted to a wide-open attribute policy. > > -DW

4 3