- Wg-pemc - mailman.kantarainitiative.org

age verification
by Tom Jones 13 Dec '23

13 Dec '23

We were arguing about age from mDL, but it seems CA is ahead of us. They support TruAge AS A SEPARATE CRED already https://www.mytruage.org/ https://www.dmv.ca.gov/portal/ca-dmv-wallet/truage/#faqs SOOOO - if the wallet has both mDL and TruAge - the wallet should pick the least invasive method. ..tom

1 0

Fwd: NEW BLOG | Progress - NIST’s Digital Identity Guidelines
by Tom Jones 12 Dec '23

12 Dec '23

It looks like 63-4 is headed for another public response period. Note that they have switched to the issuer-holder-verifier format. Most of the responses from Kantara have been from the IA folk who are focused on the audit POV. Perhaps we needs something from the developer POV? ..tom ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Tue, Dec 12, 2023 at 7:09 AM Subject: NEW BLOG | Progress - NIST’s Digital Identity Guidelines To: <thomasclinganjones(a)gmail.com> [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] Cybersecurity Insights a NIST Blog A Note on Progress…NIST’s Digital Identity Guidelines. In August 2023 the Digital Identity Guidelines team hosted a two-day workshop to provide a public update on the status of revision 4. As part of that session, we committed to providing further information on the status of each volume going forward. In fulfillment of this commitment, we wanted to offer a quick update on where we stand. Our goal remains to have the next version of each volume out by the Spring of 2024. With our gratitude for the robust and substantive engagement we received during the comment period, at this time we would like to announce that all four volumes of Special Publication 800-63-4 will have a second public comment period, which will last at least 45 days. - *NIST SP 800-63 Base Volume* <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…>. We are making substantive changes to the volume including updating the digital identity model to account for “Issuer, Holder, Verifier” frameworks of digital identity, new content... Read More <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…>

1 0

Implementor’s report for workgroup vote
by John Wunderlich 11 Dec '23

11 Dec '23

Please find attached the Early Implementors Draft for workgroup vote: Next steps: 1 Workgroup Votes: • Vote Approve • Vote Approve with suggestions (include specific suggestions for final editing) • Vote Not Approve 2. Final Editing by leadership team (assuming majority of votes cast are Approve or Approve with suggestions) 3. Submit for publication On the agenda for tomorrow: 1. Developing a cadence and calendar for asynchronous development of requirement 2. Review of voting process Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 2

SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees | CSRC
by John Wunderlich 11 Dec '23

11 Dec '23

Some of you may want to comment on this: https://csrc.nist.gov/pubs/sp/800/226/ipd Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Governments have been and will remain a major threat to privacy.
by Tom Jones 10 Dec '23

10 Dec '23

We should probably review the threat posed by eIDAS to privacy. It would be good if our guidelines were clear that government mandated monitoring is banned. https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr Be the change you want to see in the world ..tom

1 0

which federal agency should create Identifier standards?
by Tom Jones 08 Dec '23

08 Dec '23

'TSA Is Not the Right Agency to Lead' REAL ID Implementation, Security Experts Say Security and identity management experts urged Congress to direct the National Institute of Standards and Technology to play a bigger role in developing standards for digital identity management ahead of a looming 2025 deadline for domestic air travellers to comply with security requirements outlined in the REAL ID Act. "While DHS does not create standards, DHS - or even better, the White House or Congress - should request that NIST lead a timeboxed, one-year effort to create the standards and guidance needed to accelerate the deployment of secure, privacy-protecting mDL apps that Americans can use to protect and assert their identity online," Grant testified. Jay Stanley, a senior policy analyst with the American Civil Liberties Union's Speech, Privacy, and Technology Project, warned that the TSA has proposed to adopt the ISO standards, which he said were "created behind closed doors by a secretive committee" and are "inadequate and incomplete when it comes to the protection of our privacy." Sounds like Jeremy Grant is involved somehow. ..tom

2 1

Apologies for the late cancellation
by John Wunderlich 29 Nov '23

29 Nov '23

Hello; Unfortunately, today’s call has to be cancelled. I will update you with respect to the publication of the Implementor’s report and moving forward on the guidance as soon as I have something concrete to report. My recovery is proceeding, and my ability to work is coming back, so I hope this delay won’t be extended. Apologies for any inconvenience. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

The Canadian Trust framework is not inclusive
by Tom Jones 23 Nov '23

23 Nov '23

The following is one example of standards that are not inclusive that need input of the sort we are trying to produce in Kantara. It subjects human holders of digital wallets to Trust Criteria that may well have the result of preventing human beings from accessing their rights and privileges. This is why I would like to see an early report on Inclusivity. "Digital Identity Ecosystems and their associated Trust Registries use a Trust Framework (such as the PCTF) to define how Issuers, Verifiers, Holders, and Digital Wallets should or must operate to be considered trustworthy." https://diacc.ca/trust-framework-components/pctf-trust-registries/ I requested a change and got the following responses: The Trust Framework defines the “how”, which may or may not include an entry in a Trust Registry. Holders belong on that list because they can be in a position to compromise the trustworthiness of an ecosystem. Additionally, a person may be the holder of credentials, a business may be a holder of credentials, an IoT thing may hold credentials, and the wallet may hold (be the holder) of credentials for a person or a business. In this context, a Holder is more than just a person. It's a person's decision whether they want to use a digital credential or not. Much like a person can choose to pay for an item with cash or use their biometrics on their smartphone to tap payment. A person's rights or privileges are not determined by this nor is it being insinuated nor is it being enforced on citizens. At the end of the day, it's the individual's decision and choice, which Canadians have and will continue to do so, how they want to interact with the digital ecosystem. Something that is not so evident in the countries you mentioned. [Russia and China] As we can see from the following example of a first nations grandfather seeking to set up a bank account for his daughter; underserved populations are AT RISK from thinking like the above. This is a good example of why technologists should not be permitted to define standards that impact normal people. They just have no clue! A Heiltsuk man, granddaughter handcuffed outside Vancouver bank settle human rights case against police. Vancouver: CBC. Retrieved from https://www.cbc.ca/news/canada/british-columbia/maxwell-johnson-granddaught… ..tom

1 0

The Face Is the Final Frontier of Privacy
by John Wunderlich 23 Nov '23

23 Nov '23

The burden should be on the verifier to ensure that the Holder can exercise their rights. Good quick read: https://time.com/collection/time100-voices/6338338/joy-buolamwini-ai-face-p… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: No call today
by John Wunderlich 22 Nov '23

22 Nov '23

Happy American Thanksgiving. 🍗 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0