March 2016 - WG-UMA - mailman.kantarainitiative.org

Agenda for UMA legal telecon 2016-03-11
by Eve Maler 11 Mar '16

11 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-03-11 - Do these terms work for us as model definitions? - Resource Subject: Person to whom a digital data resource relates - Grantor: Person who manages access to a resource, either as its Resource Subject or that Person's behalf - Grantee: Person seeking access to a resource - How to address the subject/grantor split in the tough use cases - Tackling model clauses for RO/RSO - Does the brute force method help? - How can we address #RSctrl and #ROctrl needs – can we actually enumerate the exceptions? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

[legal] The brute-force method of specifying what a RO wants (when it comes to a RS/RSO)
by Eve Maler 11 Mar '16

11 Mar '16

Mark L and I were IMing a couple of weeks back, discussing some of the things that could constitute "consent instructions" in UMA. I ended up typing out what I thought of as what Alice (y'know, the resource owner or her proxy/guardian/agent :-) wants some RS operator "X" to do on her behalf in "plain English": - Form an agreement with me and my AS operator "Y" to put some set of resources managed by me under the protection of that AS - I might or might not have had a choice about which AS I use, or which AS operators this RS operator will work with. But once we make this agreement, any of my resources that get registered for central protection do have to be under "Y"'s protection for realsies -- and I'm going to be telling "Y" how to protect the resources so they know what to put in the token that the RS eventually gets. - Within normal UMA operations, in the general case, have the RS do what the token from "Y" says to do when a client seeks access -- that is, give access when it says to and deny access when it says to, on the basis of what the client was attempting to do - Within normal UMA operations, in *limited* circumstances (tbd to be enumerated by us if possible, with model clause support????), enable the RS to deviate -- that is, to give access when the RPT says to deny access and to deny access when the RPT says to give access - Possibly requiring the RS to send a notification message somewhere (tbd????) - Outside normal UMA operations, in *limited* circumstances (tbd to be enumerated by us if possible, with model clause support????), enable the RS to give access on request - Possibly requiring the RS to send a notification message somewhere (tbd????) This is pretty much what I as a human being would expect UMA to "mean" wrt a RSO, giving them just enough of an "out" in case they have to live up to laws in their jurisdiction etc. Is this helpful in the spirit of having both Creative Commons human-readable and lawyer-readable text? :-) Should I keep going and write a brute-force list for what the RO/ASO relationship should "mean" and so on? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Summertime skew is coming
by Eve Maler 10 Mar '16

10 Mar '16

There is a roughly two-week period starting -- if my calculations are correct -- next week, when North America and other parts of the world experience what I refer to as "summertime skew" (as in "There ain't no cure for the...") because we all start/end daylight saving time on different dates. This group treats North America as canonical because, well, it's where I live. :-) So please doublecheck the Kantara UMA WG calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>, and/or be sure you have calendar invites for our WG/legal calls showing on your own personal calendar, and/or get onto the UMA Chat on Skype, and/or browse timeanddate.com, and/or do whatever else is necessary not to miss a call during this weird period if you like joining the calls and not missing them by that much <https://www.youtube.com/watch?v=oPwrodxghrw>. If you have questions, please let me know. Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2016-03-10
by Eve Maler 10 Mar '16

10 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 MinutesDiscussion of Kantara's new organizational structure Is this new structure of any concern? It seems not; it's a mark of Kantara's growth and maturity. APAC-friendly meeting series Eve will reach out to those likely most affected if the series is changed to see if those people would mind if she offers ad hoc syncs instead. Roll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2016-02-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-25>: APPROVED Updates from recent meetings and events *IAPP Canada:* John W was approached by an IAPP Canada organizer about doing a technical presentation, and he reached out to Andrew Hughes to help put together a panel on UMA, so as to inject more interesting technicality into the proceedings. John and Eve will sync on getting some good UMA slide fodder. 40% of the IAPP is made up of lawyers, so they'll have to go for the right level. We're looking at leveraging this into another opportunity at IAPP/CSA's "Privacy. Security. Risk." event in September. Yesterday's APAC-friendly meeting had a big focus on IAPP Canada preparations. *RSA:* Eve and Josh Alexander presented, and Eve got to spend a few minutes on UMA in the talk. She has been hearing repeatedly that UMA has been coming up in "third-party" conversations she isn't in. [image: (smile)] She has die-cut stickers to give UMAnitarians, and they got snapped up at RSA. She also had interesting side conversations about health, energy, other use cases for UMA (relevant tweet <https://twitter.com/IdentityHutch/status/705827488388100098>). *HIMSS:* Not a lot of UMA-related news. Justin gave an overview to the Argonaut and FHIR project folks, and it came up in conversation a few times. Adrian observes that they don't know of any pilots. François notes that he doesn't know of pilots either. Delegation is the key unique use case, where patients can delegate access. *Btc Expo:* Adrian heard some interesting avenues there. Andi has been hearing blockchain/UMA opportunities. *CIS:* Andi notes that there is a distributed ledger/blockchain track, and a privacy track as well. Everyone please register and book hotel rooms ASAP! (And don't forget to sign up for IIW <http://eventbrite.com/e/internet-identity-workshop-xxii-22-2016a-tickets-19…> .) Why UMA? Eve has asked Domenico (our UX and graphics editor!) to put together some material for our wiki to highlight the "Why?" of UMA for businesses as an important audience. He will share his research on the list. Eve would like to ask everyone to contribute new "collateral" to this area. The impetus was Robert asking Eve for use cases, and our finding that our Case Studies page doesn't suffice. Mike asks that we present Enterprise UMA more prominently as this is an easier sell than privacy. Therefore, Mike should contribute content. What about Pedro's use case? *AI:* Eve: Approach Pedro at Red Hat about their use case. A barrier is lack of libraries, including RS support. In fact, this has just come up on the UMA Dev list, and this is the exact purpose of the UMA Dev WG, right down to putting the emphasis on the RS. Eve also likes how Nat had published an easy Hello, World OIDC client app on his blog to show everyone how small and easy it could be. There are lots of great ways other than (boring?) slideware to document and persuade about UMA: - Pumpkin security theater - John is big on putting together an interactive whiteboard why-and-how presentation - A music video <https://drive.google.com/open?id=0B7aQF7z4Xp_yQVcxLUdiZzlLUVk> (this one is about privacy generally, from RSAC) - Other ideas <http://opencreds.org/> for presentation Issue 239 The main issue in the extension spec <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…> is whether it can coexist with the main spec or whether it "stomps on" the main spec. This likely affects the extension spec title, several instances of language, and the configuration data design – it should probably invent a new endpoint that exists alongside the original endpoint. Coexistence would dictate changing our previous consensus about seeing little reason to deploy the "unenhanced" claims-gathering mechanism. Reasons for coexistence would be backwards compatibility with the existing UMA spec(s), and we still could make arguments for someone having a specialized environment that does claims-gathering and doesn't really need the enhancement. Note that the old endpoint would be marked for eventual deprecation and disabling. An important question is whether it's even possible to not support the old endpoint. George argues for it to be possible for an AS not to support the "old" endpoint on security grounds. And in fact, this could be very clean because you just don't support the "claims-gathering method" as offered by regular UMA. And now there's a draft non-normative companion doc <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…>. Eve's thinking is that all vulnerabilities found in protocols such as this should come with docs like this as a kind of FAQ. *AI:* Eve: Ask the WG about one more ad hoc meeting early next week to see about finalizing decisions on spec text so we can close out the issue next week and publish. Attendees As of 18 Feb 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. François 2. Domenico 3. Andi 4. Robert 5. Maciej 6. Eve 7. Mike Non-voting participants: - Adrian - John W - Justin - Gil - Arlene - George Regrets: - Sarah - Thomas *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Why UMA for Business
by Domenico Catalano 10 Mar '16

10 Mar '16

Hi all, I've researched a little bit about "Why Business needs UMA”. In attach a draft presentation, where I've gathered some ideas extracted and elaborated from the following resources: Customer Data: designing for transparency and trust <https://hbr.org/2015/05/customer-data-designing-for-transparency-and-trust> Social Physics and the data driven society <http://sites.nationalacademies.org/cs/groups/pgasite/documents/webpage/pga_…> New deal on Data <http://civics.com/NewDealOnData/> Extreme Trust <http://www.extremetrustbook.com/excerpt.html> The logic flow of the presentation is as follow (Know Why, Know How, Then What :-) WHY (Business Driver) Explosion of Digital technologies produces a vast quantities of data. Consumers appreciate data sharing if it can lead to products and services that make their life easer… Example (Nest, Medtronic, UBER) How social network can Make us smarter (Social Physics research by Pentland helps us to understand how idea flow from person to person through the mechanism of social learning and ends up shaping the norms, productivity and create output for companies, cities and societies). Business needs to use personal data to create best services and products, or for creating new stream of revenue. CHALLENGES Risk of Abuse increases tension and reduces the trust between consumers and companies. HOW Towards an Extreme Trust as competitive advantage New Deal on Data: approach that build trust Examples (Facebook beacon, Metadistretti e-monitor) WHAT User Managed Access: Business Value Proposition Template Target personas (template) Use Case (template) I hope it help for future extensions. Thanks. Domenico

2 1

Reviewing our issue #239 materials and considering a new mitigation idea
by Eve Maler 10 Mar '16

10 Mar '16

Maciej has prepared a new version of the extension spec, and it's now on GitHub <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…>. And thanks to input from Sarah, I've put together a companion non-normative document on the UMA wiki <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…> . In writing the final part of the companion document, I started thinking about a potential new mitigation idea when it came to describing why strong authentication *after* claims-gathering wouldn't work: I suddenly wasn't sure that strong auth doesn't work in all circumstances. *N.B.:* With this inquiry, note that my goal isn't to delay getting the word out about this whole thing! It's simply to consider any mitigation that might be reasonable, and discard it expeditiously if it doesn't fit. So I'm hoping we can examine it in our call and: a) reject it as unsuitable, b) reject it as technically suitable but failing some other criterion, or c) accept it as an alternate or additional mitigation. So here goes. Given the following: - The cycle of trust elevation (need_info) is repeatable, according to AS needs. (Which gives an interestingly flexible mechanism.) - Only trust elevation that uses the requesting party claims endpoint is susceptible to session fixation. ...I started wondering whether it *might* be viable to suggest the following as a mitigation: - The policy conditions include both some claim(s) being supplied and, *afterward*, Bob being able to authenticate, to some level of strength, as Bob. (That is, there is a certain authentication_context and identity required, whether explicitly in an error_details hint, or implicitly. Currently we only have an in-band way to indicate authentication hints, not the required identity.) Notice that a precondition for the attack is that Eve and Bob each have their own AATs, even though their clients have identical client IDs; this gives a hook for transaction context differentiation. The theory is that, if Eve were to initiate the session, phish Bob to gather his credentials, and then take over again after he's done, Eve would fail the second policy condition because she can't authenticate as Bob -- unless she also stole his credentials, and that's a different attack entirely. And if Bob started the session legitimately, then of course Eve missed her chance to phish him and he can pass the strong-auth trust elevation test himself. Recall that elevating trust through authentication_context is basically like refreshing/strengthening the AAT. If anyone wants to squeeze identity out of an AAT, it's best to use OIDC vs. plain OAuth for it. My investigations showed that using an AAT for trust elevation is not unknown -- in fact, it's known to both Gluu and ForgeRock, in cases where you expect the AS to serve as the IdP for the requesting party as well as the resource owner. I suspect there may be privacy considerations to doing this in other topologies that should be carefully examined -- such as, could a requesting party's "AAT identity" compromise him somehow if it is used as part of trust elevation in addition to "claims-based RqP identity" at the AS? I thought this was incontrovertibly true once, but I haven't been able to re-prove it to myself... That's probably enough/too much food for thought for now, from me. I know others will want to jump into the thread before the meeting with more. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 Date and Time - *Thu Mar 10,* 9-10am PT (*N.B.:* North America will change to Daylight Savings Time next week; this week is normal but *NEXT WEEK WILL BE ABNORMAL*) - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-02-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-25> - Quick reports from sync meeting, RSA, and HIMSS - (And don't forget to sign up for IIW) - Consider new mitigation thought on issue #239 and review draft extension spec and non-normative doc - Proposal for new "Why UMA?" wiki area - Charter-bashing <https://docs.google.com/document/d/1cv7MLdpC1SMubREbZX7L8E4YUPCAzKPwOCFBky6…> (if anyone has done any homework...) - AOB - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: APAC-friendly sync 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

- *Thu Mar 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., the call time = *Wed Mar 9 4pm PT*): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be added to the calendar invitation, send me a note. If you wish to be added to our Skype chat group to receive reminders before I open the bridge, include your Skype handle. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Others besides those in APAC-ish regions are welcome to join. This sync series has been useful for some who have a standing conflict with our weekly WG calls. However, the sync series doesn't "count towards quorum" if you're a voting participant. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [KI-LC] Real (and Open) Consent Workshop Announcement
by Eve Maler 06 Mar '16

06 Mar '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mark Lizar - OCG <m.lizar(a)openconsentgroup.com> Date: Fri, Mar 4, 2016 at 12:59 PM Subject: [KI-LC] Real (and Open) Consent Workshop Announcement To: Kantara Leadership Council Kantara <lc(a)kantarainitiative.org> Hi LC, FYI - Please pass on. *** Dear Colleagues, I am very happy to announce the the next workshop in our year long series of events on Consent & Design at Digital Catapult in London. *We would like to invite you to attend on March 21, from 10am to 4pm.* Here is a link to sign up and more information: <https://www.eventbrite.co.uk/e/real-consent-consent-design-tickets-22274347…> *As we are all aware consent as it currently managed online is broken and doesn’t provide people real consent. * The next workshop in the series is mapping the landscape of Consent & Design. We will be hosting some industry speakers, mapping design elements, then delving into how design aspects effect the metrics of usable consent. A topic well discussed in our first workshop <https://www.linkedin.com/groups/8484951/8484951-6111199357825007621>. The event series aims to produce a Real Consent Cookbook *for implementation, design and evaluation *of modern consent. *We will also focus on topics such as consent trust metrics, and how real consent can hep to build trust frameworks*. *We are also open to hear your suggestion in this space. If you have a topic you would like to see covered in our upcoming discussion, please let us know. * We invite you to (re) join a new LinkedIn Group <https://www.linkedin.com/groups/8484951>, specific to Real Consent topic. (to keep discussion going between workshops) Which is where you can find a summary of the last workshop. Planned Workshops: March 21: Consent & Design May 27: Trust & Consent Sept 26: Consent & Design Metrics We are proudly sponsored by the @Kantaranews and @DigitalCatapult #PDT - but we are still looking for sponsorship of the cookbook and the lunch at the workshops. If you are interested in either or both please get in touch. Kind Regards, Mark Lizar Executive Director Open Consent Group Email: m.lizar(a)openconsentgroup.com Mobile: +447738382658 Twitter: @smartopian _______________________________________________ LC mailing list LC(a)kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/lc

1 0

Reminder: No WG or legal meeting this week
by Eve Maler 02 Mar '16

02 Mar '16

Too many people traveling. Hope everyone is having a fun and productive time! Good seeing a few of you at the Non-Profits on the Loose party last night! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0