August 2016 - WG-UMA - mailman.kantarainitiative.org

Thoughts on resource set scope "math"
by George Fletcher 06 Nov '16

06 Nov '16

Assumptions: 1. In UMA, scopes are really "per user" rather than per API. Now it is unlikely, and not encouraged, that an RS would produce an API where the scopes are really unique to each user. In most cases it is more likely that the RS will have a set of defined scopes that work across their entire API and hence across all registered resources. 2. For any given resource set, a subset of the full list of the scopes supported by the RS may be registered. Sets of scopes as identified in the meeting notes from 2016-06-02 [1] 1. The universe of scopes the RS has registered for the resource set 2. The scopes the client has registered for at the AS (if it has done this at all) 1. Note that I would add to this that this list of scopes should rather be the list of scopes the AS has determined the client is allowed to request 3. What the RO has attached to the policy for the resource set 4. What the RS requests for at the permission endpoint (in order to get a ticket) 5. The scopes the client requests at the token endpoint Possible algorithm for determining the set of scopes to be issued with a permissions ticket. * The max possible set of scopes that could be returned from the /token endpoint when requesting a token is the "universe of scopes the RS has registered for the resource set" identified by the permissions-ticket * The allowed set of scopes that can be issued by the UMA AS is the INTERSECTION of "universe of scopes [#1]" and the scopes allowed by the RO policy for that resource set [#3]. Let's give this resulting set a number of [#6] {allowed scopes for the resource set} * The list of scopes requested by the client is determined by the INTERSECTION of [#2] and [#5]. Let's give this resulting set a number of [#7] {scopes the client is allowed to request} * The set of requested scopes is the UNION of set [#7] and set [#4]. Let's give this resulting set a number of [#8]. * The max scopes that can be allowed for this access_token request is the INTERSECTION of set [#6] and set [#8]. Mapping this to pseudo-code: Set PossibleScopes = RegisteredResourceSetScopes INTERSECTION ROAllowedScopes Set ClientScopes = ASAllowedClientScopes INTERSECTION ClientRequestedScopes Set RequestedScopes = ClientScopes UNION PermissionTicketScopes Set AllowedScopes = PossibleScopes UNION RequestedScopes Thanks, George [1] https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02

5 6

Thinking about shifting the Thu Sep 8 call to Fri Sep 9
by Eve Maler 01 Sep '16

01 Sep '16

We've been making pretty good "dog days progress" despite a few interruptions. *This week we definitely meet as normal* for the WG call on Thu Sep 1 and the legal call on Fri Sep 2. I've just had a conflict arise for the following week, and wonder if we should shift our call *from Thu Sep 8, 9am PT to Fri Sep 9, 9am PT*, such that the legal call would be followed by the WG call. Can I get any *"amens" in private email*? I'll reschedule if it looks viable. Unfortunately, my upcoming work travel schedule looks as insane as the IIW/EIC/CIS season did. So as to avoid lots of cancellations, *would a general "backup time" as outlined above* be useful in a pinch? Please *let me know* what you think of that option in your response too. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Comments on "Saved Consent Token"
by Domenico Catalano 01 Sep '16

01 Sep '16

Hi all, Here are some considerations/comments about SCT (Saved Consent Token): 1. SCT could be considered as session token or session identifier for managing RqP/Client interactions with AS for the trust elevation process, for keeping transparent the subsequent actions. The use case is when Bob (RqP) attempts to access to a protected resouce, obtaining a RPT+SCT. Later (10 min), when he tries to access to a new protected resource which match the previouse claims policy, having an active session (on AS), the client posts the SCT which proof that he has previously released the claims, avoiding the claims gathering again. 2. As session identifier token, it should follow the three rules: unique, random and encrypted. Validity is important as well. 3. Maybe the name "Saved consent Token" could be confusing because of "consent" word, which recall compliance terminology. I hope this is helpful for the discussion. Domenico Sent from my iPad

4 5

Agenda for UMA telecon 2016-09-01
by Eve Maler 31 Aug '16

31 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-09-01 Date and Time - *Thursdays,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-08-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-18> - Review latest editors' draft specs - Core is up to 01 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-01.html> - RSR is up to 00 <https://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-00.html> - UMA refresh/saved consent/persisted claims token? - Client awareness of scopes and set math - See 2016-06-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> , 2016-06-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-16?…>, and 2016-08-04 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-04> notes - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Submission to the Officer of the Privacy Commissioner of Canada
by Mark OCG 30 Aug '16

30 Aug '16

Hi All, I put forward a submission to the Privacy Commissioner and had a bunch of help from the friends of the consent receipt effort. The submission was changed and edited and revised more than a few times, so, not sure which version will actually be submitted and published by the OPC. But, the final version is attached and this is what is essentially being presented at Helsinki, with most of those mentioned actually presenting in the session I am hosting tomorrow at the MyData. Of course all comments and feedback are welcome, and, I hope that this might be useful to those working in this space. Kind Regards, Mark

2 1

Enjoy
by john＠wunderlich.ca 29 Aug '16

29 Aug '16

FYI For some reason this resonates Unicode Source: http://xkcd.com/1726/ (via Mr. Reader) Thanks, John Wunderlich @PrivacyCDN Pleez 4give speling errurs, sent from a mobile device. -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

The best privacy paper in years - UMA
by Adrian Gropper 28 Aug '16

28 Aug '16

The paper is a must-read for anyone trying to understand scope design of APIs as well as those that would design registries or trust frameworks to guide users that are considering signing up for an new app or web service. https://arxiv.org/abs/1608.05661 arXiv:1608.05661 (*cross-listing*) Date: Thu, 18 Aug 2016 07:36:11 GMT (2469kb,D) Title: The Curious Case of the PDF Converter that Likes Mozart: Dissecting and Mitigating the Privacy Risk of Personal Cloud Apps Authors: Hamza Harkous, Rameez Rahman, Bojan Karlas, Karl Aberer Categories: cs.CY cs.HC Journal-ref: Proceedings on Privacy Enhancing Technologies. Volume 2016, Issue 4, Pages 123-143, ISSN (Online) 2299-0984 DOI: 10.1515/popets-2016-0032 \\ Third party apps that work on top of personal cloud services such as Google Drive and Dropbox, require access to the user's data in order to provide some functionality. Through detailed analysis of a hundred popular Google Drive apps from Google's Chrome store, we discover that the existing permission model is quite often misused: around two thirds of analyzed apps are over-privileged, i.e., they access more data than is needed for them to function. In this work, we analyze three different permission models that aim to discourage users from installing over-privileged apps. In experiments with 210 real users, we discover that the most successful permission model is our novel ensemble method that we call Far-reaching Insights. Far-reaching Insights inform the users about the data-driven insights that apps can make about them (e.g., their topics of interest, collaboration and activity patterns etc.) Thus, they seek to bridge the gap between what third parties can actually know about users and users perception of their privacy leakage. The efficacy of Far-reaching Insights in bridging this gap is demonstrated by our results, as Far-reaching Insights prove to be, on average, twice as effective as the current model in discouraging users from installing over-privileged apps. In an effort for promoting general privacy awareness, we deploy a publicly available privacy oriented app store that uses Far-reaching Insights. Based on the knowledge extracted from data of the store's users (over 115 gigabytes of Google Drive data from 1440 users with 662 installed apps), we also delineate the ecosystem for third-party cloud apps from the standpoint of developers and cloud providers. Finally, we present several general recommendations that can guide other future works in the area of privacy for the cloud. -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 1

Regrets for Wednesday
by John Wunderlich 23 Aug '16

23 Aug '16

Hi; I have client meetings that have been called for 10:30 and 11:30 tomorrow, so will be unable to make the CIS and UMA workgroup calls. Regrets. Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

In lieu of a meeting next week
by Eve Maler 19 Aug '16

19 Aug '16

Hi folks-- I've made a few more edits reflecting a bit of this week's work and a few editing instructions from weeks gone by. You can seen the results in the links below (only Core saw changes). https://github.com/KantaraInitiative/wg-uma/commits/mpd-edits https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-01.html https://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-00.html I'd like to suggest that some good activities this week, for those inclined, would be to: - Review the new spec bits - Search for and study all the "[DISCUSS: ...]" parts in Core - Put some thought (and even sketched-out text??) into a more formal "UMA grant type" -- here <https://tools.ietf.org/html/rfc6749#section-4.5> is the bare minimum required by the OAuth spec and here <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-18> is what we wrote down at/after today's meeting (see final bullet list) - Weigh in on the list about all this I will hope for some interesting list discussion to catch up on as of August 27. :-) TTFN! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-08-19
by Eve Maler 19 Aug '16

19 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web interface <https://panel.turbobridge.com/webcall/>, code 178-2540# - Screen sharing: http://join.me/findthomas – NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-08-19 - Working session on User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - We can make progress with the current scenario *NOTE:* No meeting next week! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0