January 2020 - WG-UMA - mailman.kantarainitiative.org

Notes from 2020-01-28 UMA business-legal framework telecon
by Eve Maler 28 Jan '20

28 Jan '20

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2020-01-28 Attending: Eve, Domenico, Colin, Tim, Lisa This is the last time we'll be meeting at this hour where it's the "biz-legal call". We'll see what the results of the Doodle poll are in terms of a new hour. Please fill out that poll <https://doodle.com/poll/th8ahr8dnqa8zi8u>! Tim likes that the Guardianship paper really wrestles with the temporal dynamics of guardianship. Tim had introduced the concept of "diachronic" issues in our work on the first Report, though it looks like the word itself didn't survive the editing process through to the final version. These aspects reflect (literal) life cycle changes that traditional IAM typically handles through workflow approvals and the like. Colin would have liked to see a reflection of existing work. Likely people are not fully understanding both UMA and OAuth, both of which handle delegation of authorization in some subtle ways. We need to make this really easy to understand with some demos. The very first step in a Me2B relationship, delegating a guardian – or other RRA (resource rights administrator) – relationship, is not yet today interoperable in an OAuth or UMA world. Does profiling OAuth with a claim representing this semantic make sense? We looked at the original NZ POC case study <https://kantarainitiative.org/confluence/display/uma/Case+Study:+Users+Mana…> to see if it had any examples of guardianship or interesting delegation. The Aroha/Bailey use case is about "classic" delegation of access, though it includes mobile notifications of IoT data, which is nice. The ministry of education/picking up kids use case is about chaining delegation. At Kantara we produce reports and specifications. We could analyze the use cases covered by the paper; our BLT work address guardianship along with various non-guardianship delegation use cases between data subjects and RRAs. UMA's architecture and Sovrin's architecture are pretty different. However, Identos has created an extension that seems to be potentially valuable in privacy-enhancing an UMA AS in an SSI-ish context, and Adrian and his cohorts have integrated uPort for providing RqP verifiable claims. We'd like to get a broader shared understanding in the group about these options. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Doodle poll for planning future UMA WG telecons (we are meeting tomorrow!)
by Eve Maler 27 Jan '20

27 Jan '20

For *this week* (week of Jan 27), I'm going to preserve tomorrow's (Tuesday's) call as our single call. For *next week* (week of Feb 3), I'll be traveling internationally so I'm going to cancel our call(s). For *subsequent weeks* (week of Feb 10 and beyond), please fill out the following Doodle poll to see which time slot is favored: https://doodle.com/poll/th8ahr8dnqa8zi8u I'll pay closest attention to answers provided by *voting and active participants* (past, present, and "self-reported desired"). Depending on the winning hour, I may have to select a temporary alternate hour for the week of Feb 10 based on my existing obligations, but I will give everyone ample heads-up. As always, our WG calendar <https://kantarainitiative.org/confluence/display/uma/Calendar> is canonical, and I'm happy to send you a meeting invitation if you wish. I can also add you to our Skype chat, where we send timely meeting updates and notes. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Consolidating our meeting times onto Tuesdays
by Eve Maler 22 Jan '20

22 Jan '20

We currently have two weekly meeting times identified, which hasn't worked well for a while. We've also been noting for a while that we have a greater need these days for getting-the-word-out types of activities and relatively fewer of hardcore technical work. I suggested in today's biz-legal call that we keep our Tuesday call times and drop our Thursday call times. You can always see and subscribe to our calendar here <https://kantarainitiative.org/confluence/display/uma/Calendar> (and I'm happy to add people as invitees to the events). Tuesdays are at 8am PT / 10am CT / 11am ET / 4pm UK / 5pm CET. Does it cause problems for our voting participants <https://kantarainitiative.org/confluence/display/uma/Participant+Roster>, or other denizens, to turn the Tuesday call series into our "real" calls? We'd design agenda topics according to current need. I'd like to change things up starting immediately, so please speak up if you've got a challenge. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 4

TxAuth charter
by Eve Maler 21 Jan '20

21 Jan '20

If you haven't seen it, TxAuth (was "XYZ") has got some pretty stable charter language now: https://mailarchive.ietf.org/arch/msg/txauth/x5OXod7RKoHJ8NcJjbm3vxT_RE4 Of particular relevance to UMA, the scope of the effort includes (excerpted): - "widely deployed use cases currently supported by OAuth 2.0 and OpenID Connect (an extension of OAuth 2.0) as well as new use cases not enabled by OAuth 2.0" - "Approval of multiple resources and APIs in a single interaction" - "Separation between the party authorizing access and the party operating the client requesting access" [I take this to include asynchronicity as well as multiple parties] Justin may want to comment further. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from 2020-01-21 UMA business-legal framework telecon
by Eve Maler 21 Jan '20

21 Jan '20

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2020-01-21 Attending; Eve, And, Domenico, Lisa, Nancy, Tim, Colin Through her colleagues, Eve recently came upon the work of the Sovrin Guardianship group <https://sovrin.org/guardianship/> (which overlaps in some respects with our biz-legal work) and the DIDauthz work <https://github.com/hyperledger/aries-rfcs/tree/master/features/0309-didauthz> (which references OAuth and UMA). Nancy brings up the FAST work in healthcare, which is trying to accelerate solutions to common challenges. What is the best way for us to accelerate our own work and goals, and how we can center on the end-user perspective (the "User" in UMA)? Lisa notes the DIDUX working group, given this desired perspective. Tim notes the rationale stated in the paper on p. 9 for the guardianship work: "In short, carefully constructed guardianship is essential to SSI. Without it, SSI solutions will either tend towards centralisation or exclude billions of people." This is somewhat a weird way to think, in Eve's opinion, because it's constructed around the goal of digital identity (an "input metric") as opposed to what people actually want out of digital services (an "output metric"). If we don't get out of this mindset, we may not get to the point of being creative enough to solve the next generation of problems. Tim notes that the UN and the World Bank are saying that legal identity is a human right. (Though "legal identity" is not the same thing as "(a) digital identity".) She takes the sentiment of wanting to solve the thorny problem of "offline and online" mixes of people, though. Lisa suggests that we pull Adrian into an analysis. Eve thinks Justin could shed light too. Eve is going to pare down our meetings so that we only meet on Tuesdays. She'll send a note to the list just to be sure this doesn't cause any heartburn for our voting participants. Homework for next time: Everyone please study the paper and the use cases, paying particular attention to the terminology and concepts, and seeing if we have comments or could use some of them. Eve will look into her team's ability to develop demos of the use cases in the paper (or equivalent), on an UMA/OAuth basis and potentially SSI. Others are welcome to do that too. We are meeting next Tuesday. No meeting on Feb 4 as Eve is traveling. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Notes from 2020-01-07 UMA business-legal framework telecon
by Eve Maler 07 Jan '20

07 Jan '20

(I've had to cancel a couple of upcoming calls due to conflicts. Please see the calendar if in doubt.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2020-01-07 Attending: Eve, Tim, Lisa, Domenico Could UMA be additive as a solution to the human rights efforts such as in the UN? Digital human rights is a driving motivation for Lisa. Rights and corresponding responsibilities need to be ensconced in technology where possible. An old writeup <https://kantarainitiative.org/confluence/display/uma/Privacy+by+Design+Impl…> about UMA implications of Privacy by Design principles (for which the tiny URL is http://tinyurl.com/umapbd) is probably a bit out of date but helpful on this score. Me2B recently did a small ethnographic study, discovering some interesting – if perhaps nominally obvious – things about surveillance and awareness about it. There is a faction among healthcare IT people saying that informed consent is literally impossible. This is akin to the *qualia* problem: you can't inspect someone else's brain to know what they know. If this is the case, and even given that "consent is stupid", it's better to *assert permissions* as proposed in the LeVasseur/Maler paper. If people won't even read books now because their attention spans are shot in the modern era, then how can we expect them to read ToS? There's a Japanese word for the pile of books you have but haven't read, tsundoku <https://en.wikipedia.org/wiki/Tsundoku>, and now we have the digital version too. To bring the news about what UMA can solve and how it can support "IRM" challenges, we want to publish the material we've put together in smaller bites, possibly in blog posts. We talked a bit about the JLINC protocol, which can be found here <https://protocol.jlinc.org/>. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0