[WG-PEMC] Re: user privacy experience levels

All those ideas are still interesting. One that is unclear is key management - it is unclear that it should be a part of the wallet. I have built a system now being deployed where key management was created with the device as a separate function. Putting it inside the wallet app was too complex and did not scale. In any case, where-ever it may be hosted, it needs to be a separate function whenever device specific (hardware protected) keys are required. Be the change you want to see in the world ..tom On Wed, Jul 5, 2023 at 10:24 AM jim pasquale wrote:

Does this help? It was done back in 2018 and the blockchain craze.

Break it down into manageable parts originally identified:

Here are two slides in a PDF

On Jul 5, 2023, at 12:54 PM, Tom Jones wrote:

Based on my last discussion on availability of data & metadata to user i added a section on level of experience complexity and other details. See if this is helpful.

https://tcwiki.azurewebsites.net/index.php?title=Mobile_Privacy_Experience#L...

The wallet must accommodate both holder experience and legal requirements. These are often incompatible and judgement is needed. The following levels are conceptual and are based on the deviation from the norm similar to a normal distribution, so one could be considered (very roughly) within one standard deviation and so on.

1. Common case the user gets one screen that contains the purpose, a user understandable identity of the verifier (and other data controllers or providers) and the proposed summary data to be released. A user gesture is required to release the data. 2. The wallet or user decides that more information is required to be evaluated than the one screen can provide 3. The holder wants to see the full data (and metadata) that is to be released to the verifier. 4. The holder wants (or is forced) to view the terms and conditions of the issuer or verifier. 5. The holder needs to change the wallet (device/app) configuration setting to allow the data access requested.

..tom _______________________________________________ Wg-pemc mailing list -- wg-pemc@kantarainitiative.org To unsubscribe send an email to wg-pemc-leave@kantarainitiative.org