- WG-RIUP - mailman.kantarainitiative.org

RIUP WG meeting tomorrow Nov 19, 2024, 1 PM ET Here is a direct link to WG meeting (I'm hopeful this link works)
by jim kragh 19 Nov '24

19 Nov '24

Meeting link: https://us06web.zoom.us/j/87499194761?pwd=cmhDTHBXV2VTbFBMZzllMlZVbnFoZz09 Good evening to all! *1) We will take a stab at doing a near final review of the PCQ document with comments from Tom, Justin and Jorge.* *Link to the Inclusive Purpose Consent Query (PCQ) document:* https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit 2) *Tom shared this link* regarding our sister WG-PEMC] Biometric Update points to PEMC report comment period! ICYMI: https://www.biometricupdate.com/202411/kantara-wants-comment-on-privacy-rec… *3) Ranking discussion: *Mobility vs Dexterity Smartphone vs Tablet/iPad Solo vs Caregiver Have a restful evening, JIm

1 0

Fwd: [WG-PEMC] Biometric Update points to PEMC report comment period!
by Tom Jones 15 Nov '24

15 Nov '24

adding to RIUP since the DII is listed as well. Peace ..tom jones ---------- Forwarded message --------- From: Andrew Hughes <andrewhughes3000(a)gmail.com> Date: Wed, Nov 13, 2024 at 8:46 AM Subject: [WG-PEMC] Biometric Update points to PEMC report comment period! To: pemc kantara <wg-pemc(a)kantarainitiative.org> Cc: Karyn Bright <karyn(a)kantarainitiative.org> ICYMI: https://www.biometricupdate.com/202411/kantara-wants-comment-on-privacy-rec… *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>* _______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-pemc mailing list -- wg-pemc(a)kantarainitiative.org To unsubscribe send an email to staff(a)kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-pemc@kantarainitia… ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-pemc

2 1

IPCQ compliance with PEMC requirements
by Tom Jones 06 Nov '24

06 Nov '24

The PEMC requirements are out for review of all of Kantata https://kantara.atlassian.net/wiki/spaces/GI/pages/683507722/PICPR20241010 I created a list of the requirements that seem germain - on first review it seems that the IPCQ is in compliance with the PEMC. I would like others to take a look to see if there is agreement. Attached are my notes on the relevant parts IMHO. (John - i did run into one requirement that was not clear - if there are other comments perhaps we can open this one as well.) 265 Establish the Context for User Consent 266 Verifiers shall establish valid consent at or before the Holder presents any information from a Mobile Credential (tj – not sure what this means) Peace ..tom jones

1 0

RIUP WG meeting tomorrow November 5, 1 PM ET
by jim kragh 05 Nov '24

05 Nov '24

*Setting the stage:* Tom sent a link out about an hour an hour ago thanking Bev for sharing a document https://edtechmagazine.com/higher/article/2024/11/what-self-sovereign-ident… and responded: - I read it to say that it puts privacy in the hands of the subject of the credential. As things stand today this is flat wrong and I think we need to understand why. Thanks Tom for sending your recent message to the WG. That was the focus of my message (below) last week. There are two items in play for our meeting tomorrow regarding the PCQ document: the 'consent-recept' that Tom and Sal have advanced in prior meetings (security, privacy, access control, audit trail) and so noted as one of the 23 findings in the *Internet of Things Advisory Board's report*. ( https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-progr…) The 2nd item, which Justin has also shared some thoughts on, is a secondary communication back-up structure/node when the internet goes down. Have a nice evening and please review the updated content that Tom shared,....comments can be made directly to the doc https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… Jim *https://us06web.zoom.us/j/87605872193?pwd=HQI7AJKhLvpgtUxKyOYANVUKzsZW3U.1 <https://us06web.zoom.us/j/87605872193?pwd=HQI7AJKhLvpgtUxKyOYANVUKzsZW3U.1>* *Meeting ID: 876 0587 2193Passcode: 157149 * One tap mobile +13052241968,,87605872193#,,,,*157149# US +13092053325,,87605872193#,,,,*157149# US Dial by your location • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 669 444 9171 US • +1 689 278 1000 US (Last week's message)! At the last meeting Tom J. led the discussion on reviewing the draft *Inclusive Purpose Consent Query* (PCQ) document. Nearing the end of that call a question was raised, what happens when the internet is taken down by a hurricane, or tornado? What might be a fallback network, or infrastructure, FEMA or FirstNet, or is there some other possible solution? The forgoing became real for me during the recent hurricane that visited Florida and North Caroline. Florida was bad but NC was devastating. My dear friends, who live nearby, have family and friends there, as did I, but they suffered the loss and had injuries. Within two days, my friends stocked up their RV and headed to NC and were shocked at the destruction. Several days later, they sent me the message (below) that raised the communication challenge that Tom raised two months ago and again earlier this month. [Here is the message I received from NC: "Private retired military personnel from Florida are desperately trying to find private helicopters to rescue victims. In other words the government is not only helping but are trying to prevent others from doing so (no way to communicate). For those interested, this link is a video by SEAL Shawn Ryan about several rescue teams in NC mountains now: https://youtu.be/KgPYPEnmYnc?si=0bxMPDvxydsxaP-s Please find attached an updated PCQ draft, (*Inclusive Purpose Consent Query*, *Version 7*, KI-RUIP-WG draft-Date 2024-10-15) which is updated for your review and input for our November 5th meeting. Yes, please vote, and please review the document so you are ready to contribute to the WG discussion. Have a good week and thank you.

2 2

self sovereign ID - is it really?
by Tom Jones 04 Nov '24

04 Nov '24

Thanks for sharing this Bev - I read it to say that it puts privacy in the hands of the subject of the credential. As things stand today this is flat wrong and I think we need to understand why. As Sal has been telling us - we need transparency when asked to share our data. The current spec for that: OID4VP completely fails to provide the user with the information that they need in order to make an informed decision to consent to sharing data. It also fails to work at all in the case where in-person presentation is made and cannot be used in the disaster case mentioned by Justin and Jim. It also fails to allow for delegation and inclusion. Perhaps this will be changed before standardization, but the push to get something done fast argues against that. The linked doc is designed to fix these problems - please come tomorrow prepared to discuss. Comments can be made directly to the doc. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… ================== Sharing FYI: Security What Is Self-Sovereign Identity, and Could It Impact Higher Education Cybersecurity? Advocates of SSI say the nascent philosophy would put personal data back in the hands of the people. But how realistic is that, and how far away is an actual solution? https://edtechmagazine.com/higher/article/2024/11/what-self-sovereign-ident… Peace ..tom jones

1 0

No RIUP WG meeting tomorrow; we meet on 1st and 3rdTuesday’s. Please prep and read the attached for Nov. 5th; reminders to follow:
by jim kragh 04 Nov '24

04 Nov '24

Good Evening to all! At the last meeting Tom J. led the discussion on reviewing the draft *Inclusive Purpose Consent Query* (PCQ) document. Nearing the end of that call a question was raised, what happens when the internet is taken down by a hurricane, or tornado? What might be a fallback network, or infrastructure, FEMA or FirstNet, or is there some other possible solution? The forgoing became real for me during the recent hurricane that visited Florida and North Caroline. Florida was bad but NC was devastating. My dear friends, who live nearby, have family and friends there, as did I, but they suffered the loss and had injuries. Within two days, my friends stocked up their RV and headed to NC and were shocked at the destruction. Several days later, they sent me the message (below) that raised the communication challenge that Tom raised two months ago and again earlier this month. [Here is the message I received from NC: "Private retired military personnel from Florida are desperately trying to find private helicopters to rescue victims. In other words the government is not only helping but are trying to prevent others from doing so (no way to communicate). For those interested, this link is a video by SEAL Shawn Ryan about several rescue teams in NC mountains now: https://youtu.be/KgPYPEnmYnc?si=0bxMPDvxydsxaP-s Please find attached an updated PCQ draft, (*Inclusive Purpose Consent Query*, *Version 7*, KI-RUIP-WG draft-Date 2024-10-15) which is updated for your review and input for our November 5th meeting. Yes, please vote, and please review the document so you are ready to contribute to the WG discussion. Have a good week and thank you. Be well, JIm

3 2

agenda suggestion for meeting tommarow
by Tom Jones 28 Oct '24

28 Oct '24

we have this document from the last meeting - do we want to edit it or accept it as a formal work item. https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… the MAAS might be ready for review - is that a useful agenda item? Peace ..tom jones

1 0

Fwd: mDL use cases.
by Tom Jones 16 Oct '24

16 Oct '24

I would like to call out the team that is focused on Inclusive Identifiers - Entidad, also a contributor to Kantara. *Most Compelling and Most Socially Impactful* Team Entidad Use Case – Integrating mDL for nonprofits to reach and enroll underserved community members into social benefits programs. Peace ..tom jones ---------- Forwarded message --------- From: Marc L. Aronson <maronson(a)notary.org> Date: Wed, Oct 16, 2024 at 6:20 AM Subject: mDL use cases. To: John Wunderlich <john(a)wunderlich.ca>, Tom Jones < thomasclinganjones(a)gmail.com> *CA DMV Recognizes Companies for Outstanding mDL Use Cases at First Community Hackathon* *October 10, 2024* *Sacramento* – The California Department of Motor Vehicles (DMV) today announced recognition awardees of its first community hackathon focused on expanding the use of the California mobile driver’s license (mDL). Held at the Computer History Museum in Mountain View on October 1, 2024, this event brought together over 50 participants representing leading private sector businesses and innovators. Teams presented a range of use cases designed to enhance secure, privacy-focused digital identity solutions using the California mDL. The hackathon highlighted the versatility and potential of mDLs in various industries, from financial services to retail, and showcased proposals addressing privacy and security, user experience, and social impact. “We were impressed by the innovative solutions presented by the teams. Their efforts underscore the mDL’s potential to empower Californians to verify their identity in a safe and privacy-conscious way,” said DMV Director Steve Gordon. “These use cases demonstrate how mDL technology can impact both private and public sectors to the benefit of their customers.” The following teams were recognized at the event for their outstanding contributions: - *Most Compelling and Most Socially Impactful* Team Entidad Use Case – Integrating mDL for nonprofits to reach and enroll underserved community members into social benefits programs. - *Most Promising* Team Cisco VC Verifiers Use Case – Using mDL as a root digital identity to enable password less authentication. - *Best Privacy and Security Design* Team Block Use Case – Leveraging mDL for point-of-sale age verification of age-restricted products sold by Square merchants. - *Most Scalable* Team US Bank Use Case – Implementing mDL for in-person identity verification at bank branches, specifically for high-risk transactions. - *Best User Experience* Team UltraPass Use Case – mDL, combined with encrypted biometric authentication, to streamline account creation for new users and helps businesses prevent users from creating duplicate accounts. - *Best Presentation* Team MATTR (MATTR, Samsung, Treez, Nuvei) Use Case – mDL for identity and age verification in cannabis dispensary and delivery services. - *Best Independent Submission * Team UFI Use Case – Integrating mDL into existing Identity and Access Management (IAM) systems. The hackathon, co-hosted by the OpenID Foundation, demonstrated the increasing acceptance of mDL technology and its potential to provide Californians with a convenient, secure, and privacy-protecting identity verification option and businesses an effective way to reduce fraud and improve operational efficiency. The DMV plans to continue exploring mDL’s potential through future events, including a second hackathon scheduled for November 1 in Sacramento, which will focus on public sector applications. Local, state, federal and international government entities will participate in this event. The DMV’s mDL pilot, available through the California DMV Wallet app, continues to evolve with more than 780,000 Californians already participating. For more information on how to enroll, visit dmv.ca.gov/mdl. https://www.dmv.ca.gov/portal/ca-dmv-wallet. We'd love to hear about your experience with us here <https://notaryne.ws/feedback>! *Marc L. Aronson * President & CEO *Pennsylvania Association of Notaries* p: 800-944-8790 x113 | f: 800-707-7075 maronson(a)notary.org | www.notary.org <https://www.notary.org?utm_medium=email&utm_source=direct&utm_campaign=empl…> One Gateway Center, Suite 401 420 Fort Duquesne Blvd., Pittsburgh, PA 15222-1498 <https://www.linkedin.com/company/pennsylvania-association-of-notaries> <https://www.facebook.com/PaAssocNotaries> <https://www.instagram.com/paassocnotaries/> <https://www.tiktok.com/@panotaries> <https://www.youtube.com/user/PaAssocNotaries> This message (including any attachments) is confidential and may be privileged. If you have received it by mistake, please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. The Pennsylvania Association of Notaries (PAN) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. PAN does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference.

1 0

Purpose and Consent Query message output from today's meeting.
by Tom Jones 16 Oct '24

16 Oct '24

https://docs.google.com/document/d/1n7HobJ6QTsNld5rn1uuIiNw0A__L44ug/edit?u… I addressed all comments and added a diagram with accompanying text. A few were not taken mostly for stylistic reasons. Please see if the attached line fairly represents all the comments received. I did need to make editorial adjustments. Comments may be made directly on the attached document. Peace ..tom jones

1 0

RIUP WG session tomorrow October 15 at 1 PM ET
by jim kragh 15 Oct '24

15 Oct '24

*Meeting ID: 876 0587 2193Passcode: 157149 * One tap mobile +13052241968,,87605872193#,,,,*157149# US +13092053325,,87605872193#,,,,*157149# US Dial by your location • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 669 444 9171 US • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US Good evening to all! As was shared at our last meeting, Jorge was not online, being he was headed to a 'Community Hackathon', sponsored by California's Department of Motor Vehicles, in the SanFrancisco bay area. There were 50 competing teams and his team captured one of the top trophies. He will provide a little insight about his Entidad team, and will share his 'hands-on' competitive experience along with the unique features and application functions that captured DMV's attention. Please note in the DMV press release, below, the winning teams and the seven award winning categories......which could be topics for discussion relating to our DII document. I have also attached an updated,draft, *Inclusive Purpose Consent Query (IPCQ**),* Version 6 KIWG, 2024-10-01*;* for your review and comments*.*. Have a restful evening, Jim https://www.dmv.ca.gov/portal/news-and-media/news-releases/dmv-recognizes-c… Purpose Consent Query 2 Oct 1 24.docx (26K) <https://mail.google.com/mail/u/0?ui=2&ik=5ec2d9d465&attid=0.1&permmsgid=msg…>

1 0