April 2025 - Wg-pemc - mailman.kantarainitiative.org

Reminder: PEMC Call Today
by John Wunderlich 30 Apr '25

30 Apr '25

I’m hoping to get quorum today so that we can talk about the conformance testing work we need to do. https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/969703425/2025-04-30+… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

REAL-ID FAQ: What will happen at US airports on May 7, 2025? – Papers, Please!
by John Wunderlich 25 Apr '25

25 Apr '25

https://papersplease.org/wp/2025/04/22/real-id-faq-what-will-happen-at-us-a… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Re: [Openid-specs-digital-credentials-protocols] Second WGLC for OID4VP
by Tom Jones 24 Apr '25

24 Apr '25

Here is a Dark Pattern of Verifier requests that was actually seen in the California mDL trials run lately. The Verifier will get permission (or whatever it might be called) to ask for a collection of purposes, for example a convenience store could be selling chewing gum, hard liquor and sim cards for smartphones. This is what the ecosystem allows it to ask for, along with payments. So if I buy a stick of chewing gum and decide to pay with my EUDIW, it is within the approved permissions for this store to ask intrusive questions that apply to purchasing liquor or sim cards, which are very intrusive in some countries. Peace ..tom jones On Tue, Apr 22, 2025 at 3:53 PM Joseph Heenan via Openid-specs-digital-credentials-protocols < openid-specs-digital-credentials-protocols(a)lists.openid.net> wrote: > Dear DCP Working Group Members, > > > As discussed on today’s (yesterday now for some of you!) working group > call (and as per my email) we would like to start a get WG consensus that > the current OpenID4VP draft is ready to start the final specification > approval process. > > Please respond to this email within the next 2 days, by end of Thursday > 22nd April, whether you believe the current draft should proceed to the > public review or not. > > The OpenID4VP document to be reviewed can be found here: > https://openid.net/specs/openid-4-verifiable-presentations-1_0-27.html > > There is one normative PRs that we agreed during the working group meeting > to work on during working group last call (just waiting for final reviews > please!): > > Rename authorization_encrypted_response_enc parameter > https://github.com/openid/OpenID4VP/pulls > > The above should resolve the point Mike Jones raised during WGLC. > > There’s an ongoing attempt to understand Tom Jones’s issue raised during > WGLC. > > There’s also a few non-breaking improvements in PRs that may be merged > before public review. > > If there are other topics working group members think need to be handled > before the specification moves to final please reply to this email with > details. > > This is very much just a step on the journey, and it is likely that > comments will arrive during the 60 day review period that the working group > chooses to fix before the voting period starts. > > The details of the specification approval process can be found here: > https://openid.net/wg/resources/approving-specifications/. > > This email is about the first bullet point on this list "Obtain working > group consensus to propose foundation-wide approval of the draft > specification", which is often called Working Group Last Call (WGLC). > The following steps are to start a 60-day Foundation-wide review, followed > by the 7 day voting period (the poll itself will open 7 days before the end > of the Foundation-wide review ends). > > Kindest Regards, > Editors & Chairs > > -- > Openid-specs-digital-credentials-protocols mailing list > Openid-specs-digital-credentials-protocols(a)lists.openid.net > > https://lists.openid.net/mailman/listinfo/openid-specs-digital-credentials-… >

3 2

the current OID4VP standard is (IHMO) not compliant with PEMC
by Tom Jones 23 Apr '25

23 Apr '25

This issue from the still evolving spec shows (IMHO) that the spec currently planned for the EUDIW (and other) ecosystem will not meet the PEMC because it is not clear how informed consent is achieved. Complexity is (IMHO) not a good answer in the world of AI and human inattention. https://github.com/openid/OpenID4VP/issues/333#issuecomment-2816774542 So what to do? Allow the sort of obfuscation that the OIDF spec demands? Or to take arms against a sea of complexity and by opposing, end it. Kantara has proposed an alternative solution that avoids the complexity. Peace ..tom jones

2 2

reminder: no PEMC call today
by John Wunderlich 23 Apr '25

23 Apr '25

Talk next week Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Conformance Testing for PEMC participants
by John Wunderlich 16 Apr '25

16 Apr '25

Hi; The group's next meeting is in two weeks, and I would like to start the work on conformance testing. There are two artefacts: A conformance spreadsheet that an organisation can use to assess their level of conformance against PEMC: https://docs.google.com/spreadsheets/d/1kxUWyCnL-KKGBVzDsvLMujmDM7ItEPtlGs5… A companion document to provide documentation to support organisations that may be self assessing against the standard: https://docs.google.com/document/d/1sDS2F7ndtGnc1jFY4yIfvsdpai1Y5s9ZFfFCVX5… I strongly encourage work group members to attend the call on the 30th to help lay out the work and identify any issues. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Hope to see you for tomorrow’s PEMC call
by John Wunderlich 15 Apr '25

15 Apr '25

Let’s celebrate the publishing of the report. https://kantara.atlassian.net/wiki/x/AYDMOQ Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

FW: NEW | Privacy Framework 1.1 Initial Public Draft Release
by Salvatore D'Agostino 14 Apr '25

14 Apr '25

From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Monday, April 14, 2025 3:07 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: NEW | Privacy Framework 1.1 Initial Public Draft Release <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248…> View As Web Page<https://links-1.govdelivery.com/CL0/https:%2F%2Fcontent.govdelivery.com%2Fa…> <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280…> NIST Cybersecurity and Privacy Program NEW | Privacy Framework 1.1 Initial Public Draft Release NIST is pleased to announce the release of the Privacy Framework 1.1 Initial Public Draft (IPD)<https://links-1.govdelivery.com/CL0/https:%2F%2Fdoi.org%2F10.6028%2FNIST.CS…>! The NIST Privacy Framework is a “living” tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1. This update builds on the success of Privacy Framework 1.0 by responding to current privacy risk management needs, realigning with NIST Cybersecurity Framework (CSF) 2.0, and enhancing usability. The following resources are included with the Privacy Framework 1.1 IPD release: * Privacy Framework 1.1 IPD Highlights video<https://links-1.govdelivery.com/CL0/https:%2F%2Fvimeo.com%2F1075421918%2F57…> that summarizes the development process and reviews key updates. * Mapping of Privacy Framework 1.0 Core to Privacy Framework 1.1 Core<https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fdocument%2Fp…> to help organizations trace changes to Core Categories and Subcategories between Framework versions. NIST welcomes stakeholder feedback on the Privacy Framework 1.1 IPD by June 13, 2025. For more information, including a comment template and instructions for submitting feedback, please click the button below. To receive periodic updates and hear about other opportunities to engage, subscribe to our Privacy Engineering mailing list<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. If you have questions, please contact us at privacyframework(a)nist.gov<mailto:privacyframework@nist.gov>. Read More<https://links-1.govdelivery.com/CL0/https:%2F%2Fcsrc.nist.gov%2Fpubs%2Fcswp…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: privacyframework(a)nist.gov<mailto:privacyframework@nist.gov> Connect with us <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.facebook.com%2FNIST/1/0…><https://links-1.govdelivery.com/CL0/https:%2F%2Ftwitter.com%2FNIST/1/010001…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.youtube.com%2FNIST/1/01…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.linkedin.com%2Fcompany%…><https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.instagram.com%2Fnist%2F…> Received this email from a friend? Subscribe here<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…>. <https://links-1.govdelivery.com/CL0/https:%2F%2Fwww.nist.gov%2Fitl/1/010001…> Subscriber services: Manage Preferences<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Unsubscribe<https://links-1.govdelivery.com/CL0/https:%2F%2Fpublic.govdelivery.com%2Fac…> | Help<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…> _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com<https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.govdelivery.…>. Technical questions? Contact inquiries(a)nist.gov<mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 <https://links-1.govdelivery.com/CL0/https:%2F%2Fsubscriberhelp.granicus.com…> <https://links-1.govdelivery.com/CI1/0100019635b28839-3eb0c0d8-62b7-4ac6-a21…>

1 0

Boarding passes and check-in could be scrapped in air travel shake-up | Air transport | The Guardian
by John Wunderlich 14 Apr '25

14 Apr '25

PEMC, an idea whose time has come: https://www.theguardian.com/world/2025/apr/11/boarding-passes-and-check-in-… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

No Work Group Call today
by John Wunderlich 09 Apr '25

09 Apr '25

If you are at IIW, I am planning a PEMC session with news about the ballot on the report. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0