- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA Legal telecon 2016-05-27
by Eve Maler 26 May '16

26 May '16

We will continue the threads begun last week. Please forgive the lack of a formal agenda, and see the link below for all details: http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Draft minutes of UMA telecon 2016-05-26
by Eve Maler 26 May '16

26 May '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-26 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecons 2016-04-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14> and 2016-05-19 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-19>: So approved. Review of MPD We're looking at the swimlane. The first batch of changes in MPD is around discovery. These are backwards-incompatible, but not particularly invasive. Justin and Sarah note that the discovery document (currently known as AS configuration data) is relevant to both the RS and the client, and thus it isn't specific to what UMA calls Phase 1. The alignment done here is to OIDC; OAuth is undergoing its own alignment to OIDC as well. Do we want to align with the other specs in terms of terminology: discovery document vs. configuration data? We have consensus to do this. Justin suggests an editorial comment in the spec commenting that it's a good idea to use an interactive grant flow when, as is typically the case, an individual end-user is a resource owner. This gives the developer the clearest guidance as to which grant to choose. This would be paired with stronger normative text that identifies the RS as an OAuth client. The editorial comment could then also briefly mention the converse case of an organization ("legal person") using the client credentials grant (and point off to the UIG if warranted). If there's a discovery document at .well-known, is it ever a good idea to rely on discovery some other way? Should we make discovery by that means optional? We're covered on this by saying "as needed" already. The UMA client now needs client credentials, not because it needs an AAT (one of the reasons before), but because it would need it for the exact role that an OAuth client would normally need it – and now, Bob the RqP would be the end-user who is using that client at the AS (specifically, the *token*endpoint that the AS already has, and has had all this time, along with a newly conceived *claims* endpoint). The loop in the swimlane involves trading a ticket for a token – repeatedly, until success. This is very analogous to an authorization code flow. Per OAuth, OIDC, and our recent security work, tickets are now one-time-use only. Note that the "claims" process treats what was previously a separate flow – step-up authentication – as subsumed into the same flow. It's possible for the client to send claims directly to the token endpoint directly. One question to discuss on the next call: Is there an in-band mechanism by which the RqP can authorize that flow? The claims endpoint can be treated as a "dispatch" endpoint. Swimlane tasks: - We should take out the Phase 1 label from the swimlane. Spec tasks: - Align the terminology and syntax of the discovery document format. - Insert the editorial comment about which grants are appropriate and normative text about the RS being an OAuth client. (Also consider a figure about the protection API being protected by OAuth.) - Implement the change for issue #155. - Where the protocol flow currently casually uses declarative text, switch to using normative RFC 2119 text. Attendees As of 15 Apr 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Nagesh, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Nagesh 3. Andi 4. Robert 5. Eve 6. Mike 7. Sarah Non-voting participants: - Justin - Adrian - Colin - Jin - John - James Regrets: - Maciej - Sal? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-05-26
by Eve Maler 25 May '16

25 May '16

Date and Time - *Thu May 26,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-04-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14> and 2016-05-19 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-19> - MPD - Review new sequence diagram <http://www.websequencediagrams.com/files/render?link=2DdzslbnVj3ShhlrLVV-> - Discuss affordances and implications - Discuss - News from Digital Contracts event - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2016-05-19
by Eve Maler 19 May '16

19 May '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-19 MinutesRoll call Quorum was reached. Approve minutes tbs CIS prep Don't forget about Cloud Identity Summit <https://www.cloudidentitysummit.com/en/index.html>. It's not too late to register (contact Andi Hindle for assistance, wink wink). There's a Kantara Summit, an UMA talk, an UMA MasterClass, a HEART talk, and a privacy track, all relevant to what we do here. (And: BLOCKCHAIN!!!!) Eve, Colin, Andi, George, Maciej, Sarah, Justin, and Ishan are all attending – and speaking. Nagesh *may* attend. Meeting schedule Let's put next week's meeting back on the calendar. Huzzah. We'll have a good long stretch of meetings through June and July. Any huge absences? Please let Eve know. IIW and EIC recaps At IIW, beyond the "MPD" discussion: - Adrian convened a session where we discussed blockchain/smart contract implications for UMA. Think "escrow" where payment for access to a resource could be worked out, or proving certain elements of identity in a wide ecosystem. - Eve created a diagram describing different kinds of delegation: RO-to-AS (as an "agent" for executing to Alice's wishes), RO-to-RqP (delegating access to resources), and Resource Subject-to-Grantor (offline wrt the protocol, but an important business/legal relationship). - Adrian brought up ten kinds of "self-sovereign technology", different from self-sovereign identity". Think about a "personal" type of UMA authorization service. Contact Adrian for more information. At EIC: - Eve gave a keynote <https://www.kuppingercole.com/watch/eic16_keynote_maler> that centered on UMA (and a HEART use case). Lots of discussion. - Ian gave a keynote where he called for an identity p - rofessional association; Kantara put up a pledge signup site <https://kantarainitiative.org/digital_identity_professional/>! Justin's change proposals For reference: The wide ecosystem challenge analysis <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…> document. The challenges came from two sources: the identity protocols used to convey identity/claims require pre-established trust, and UMA itself requires a pre-established AAT. Justin's proposals eliminate the AAT (much as a very old version of UMA had only two tokens) and do a bunch of other cleanup, which tackles not only #wideeco but also #simplify. We walked through the bullets in Justin's original email. *Changes include:* *- Removal of the RPT endpoint, in favor of using the token endpoint and a new grant type (#153)* *- Removal of the AAT (#154)* *- Removal of extraneous bits of the resource set registration URL pattern (#155)* *- Alignment of the discovery document with OIDC discovery (#157)* *- Removal of “version” field in discovery document, instead document is published under new .well-known URL pattern (#159)* *- Change use of “scopes” name in responses to something more explicit (#158)* *- Ability of client to specify scopes in token request (#165)* *- Addition of the claims-gathering URL to the need_info response, removal of “redirect_user” as redundant in this case (#167)* *- Simplification of the “need_info” response structure, removal of extraneous object layers (#237)* *- Rotation of ticket values on all requests to token endpoint or claims endpoint to mitigate session fixation and related attacks (#239, #205)* Discussion about "Ability of client to specify scopes in token request": In UMA V1.x, the flow is client-to-RS-first. The client is entirely "dumb" with respect to what scopes are available, and can only attempt access using one scope at a time, and the RS is entirely in control about how many scopes to register: one (stingy), or more than one (generous). Sarah suggests that Justin's motivation is privacy preservation: The client could essentially do a downscoping by requesting fewer scopes than the RS would have requested. But is this the motivation? Are both motivations relevant (downscoping and upscoping)? Also, does Justin's change enable an additional client-to-AS-first flow or is it still client-to-RS-first alone? If the client approaches the AS, how does the client indicate the specific RO and resource needed – does it need to know the *rsid*? On balance, might there be privacy-destructive aspects if Alice ends up sharing more access? Eve had pointed out at IIW that the asynchronous nature of the RO's control means that the client shouldn't really get to say what scopes it requests anyway. George thinks it's more of a negotiation. And maybe negotiation among RS, C, and RO isn't entirely bad? To be discussed on the legal subgroup call. [image: (smile)] It will be key to have accurate swimlanes and hopefully some spec text to stare at during next week's call. Attendees As of 15 Apr 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Nagesh, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Nagesh - Accenture and JPMorgan Chase experience in IAM - now at Optiv and working at home with schedule flexibility! 4. Andi 5. Robert 6. Eve 7. Sarah Non-voting participants: - Adrian - John W - Jin - Ishan - George - Colin - Scott Regrets: - Sal - Mike *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA legal telecon 2016-05-20
by Eve Maler 18 May '16

18 May '16

Our legal subgroup is another meeting series that's been quiet for a little while -- but we'll meet again on Friday! http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-05-20 - Review IIW and EIC discussions – progress around RSO-ASO as an "agent" - Upcoming Digital Contracts conference with opportunity to gather requirements for CommonAccord IDE and feedback on our work - Reality check on model clause process – definitions seem a lot easier, vs. clauses without a "live" agreement to work towards Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-05-19
by Eve Maler 18 May '16

18 May '16

Yes, we finally have another meeting! Please make every effort to attend. http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-19 Date and Time - *Thu May 19,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Meeting schedule - Still spotty; when can we manage to keep meetings on the calendar? - Approve minutes of UMA telecon 2016-04-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14> - Past and upcoming events - News from IIW and EIC - Preparing for CIS - Other goings-on - Justin's "multi-party delegation" <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/langui…> change proposals - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 3

Re: [WG-UMA] Privacy policy or privacy notice: what's the difference? | CIO
by John Wunderlich 17 May '16

17 May '16

+1 Robin And your list's order correctly, I think, captures the inverse relationship between operational privacy and privacy theatre. On Thursday, 5 May 2016, Robin Wilton <racingsnake(a)fastmail.fm> wrote: > +1 > > Ian Glazer and I wrote about this in our Gartner days (so the results are > hidden behind the Gartner paywall, regrettably...). > > However, a similar discussion surfaced at the ethical data-handling > workshop I ran last Friday, and we distinguished between the following > layers: > > > - Privacy policy statement ( = privacy notice, as defined here); the > outward facing doc saying what you want customers to hear. > - Privacy policy: the internal statement of what the organisation thinks > it should do > - Business process: the internal statement of what the organisation thinks > it does > - Actual behaviour > > R > > On Thu, May 5, 2016, at 07:23 PM, John Wunderlich wrote: > > Useful reading. I’ve written both privacy policies and those things on web > sites ‘called’ privacy policies. They are infrequently the same thing. This > piece captures the difference reasonably well. > > > http://www.cio.com/article/3063601/privacy/privacy-policies-and-privacy-not… > > > > Sincerely, > John Wunderlich > @PrivacyCDN > > Call: +1 (647) 669-4749 > eMail: john(a)wunderlich.ca > <javascript:_e(%7B%7D,'cvml','john(a)wunderlich.ca');> > > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > This message contains confidential information and is intended only for the > individual named. If you are not the named addressee you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately by e-mail if you have received this e-mail by mistake and > delete this e-mail from your system. If you are not the intended recipient > you are notified that disclosing, copying, distributing or taking any > action in reliance on the contents of this information is strictly > prohibited. > *_______________________________________________* > WG-InfoSharing mailing list > WG-InfoSharing(a)kantarainitiative.org > <javascript:_e(%7B%7D,'cvml','WG-InfoSharing(a)kantarainitiative.org');> > http://kantarainitiative.org/mailman/listinfo/wg-infosharing > > Robin Wilton > +44 (0)705 005 2931 > -- John Wunderlich Fat fingered from a mobile device Pleez 4give spelling errurz! -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

5 13

Re: [WG-UMA] Privacy policy or privacy notice: what's the difference? | CIO
by John Wunderlich 06 May '16

06 May '16

Robin; Have you looked into how what you are proposing aligns (or not) with the Ruggie rules and the UN Guiding Principles on Business and Human Rights? John Wunderlich, Sent frum a mobile device, Pleez 4give speling erurz _____________________________ From: Robin Wilton <racingsnake(a)fastmail.fm> Sent: Friday, May 6, 2016 7:56 AM Subject: Re: Privacy policy or privacy notice: what's the difference? | CIO To: John Wunderlich <john(a)wunderlich.ca>, Adrian Gropper <agropper(a)healthurl.com> Cc: wg-uma <wg-uma(a)kantarainitiative.org>, Information Sharing Work Group <wg-infosharing(a)kantarainitiative.org> Hi both - This (emboldened, below) is also the reasoning behind the ethical data handling (EDH) work I'm doing in ISOC at the moment. My aim is to increase stakeholders' focus on EDH by providing rationales and practical guidance throughout the product/data lifecycle. Obviously, data subjects ought to like the idea, because it is likely to respect their interests more than the status quo does.It's trickier to build a compelling case for corporates to adopt EDH (for the reason John suggests below) - but I think there are possibilities: - stating ethical principles externally gives customers and potential customers an indication of good faith - which should have a reputational pay-off for the business; - setting ethical principles internally should help foster a culture of ethical behaviour, which is nice and cuddly, but it should also have the consequence of making compliance easier to achieve and demonstrate. That's a hypothesis, but I propose it because I think people behave better when they buy into the reasons for their behaviour... and "because it's in line with our respect for the customer" is a more powerful motivator than "because I have to tick these compliance boxes". (In terms of the layers I described earlier, it builds a stronger link between stated principles and actual behaviour). If the corporate is both respecting the customer and finding compliance easier to achieve, I believe it is more likely to be effectively mitigating privacy risk, too. As I say, making this compelling for corporates is one of the tricky bits: if anyone has other ideas/suggestions about building the business case (or building the case for non-commercial data controllers, of course!), please please let me know... I'll be speaking on this at CIS New Orleans, University of Vienna, OIX Rome, EWTI Vienna, etc., and you will get full attribution for any contributions!! (That's naked bribery, I know, but who said I was proud?) ;^) Best wishes,Robin On Thu, May 5, 2016, at 10:55 PM, John Wunderlich wrote:Criticizing corporations for focusing on compliance and managing liability is kinda like critiquing a lion for being a carnivore. I take your point, but the solution involves citizen/customer/patient activism to change the context - like patient privacy rights is doing. But in the meantime, some corporations and some individuals in corporations want to do the right thing, and should be supported. I don't want to Brandon the field just yet. On Thursday, 5 May 2016, Adrian Gropper <agropper(a)healthurl.com> wrote:I find articles like this and most of what IAPP stands for deeply upsetting. Everything is from the perspective of the institution, mostly compliance. There is not a single mention of the subject's perspective, much less sympathy. My guess is that 90% of Privacy Notices are 90% identical to the Staples example. Why isn't anyone calling for privacy notices to be standardized - with exceptions for the 10% that might be actually interesting or differentiating? Because of IAPP and the entire mini-industry that lives off surveillance capitalism. Shameful. Adrian On Thursday, May 5, 2016, John Wunderlich <FastMail WARNING: URL text contains a possible JavaScript attack on your machine. URL disabled. Original URL='javascript:_e(%7B%7D,'cvml','john(a)wunderlich.ca');'. For more information on phishing click here.> wrote:+1 Robin And your list's order correctly, I think, captures the inverse relationship between operational privacy and privacy theatre. On Thursday, 5 May 2016, Robin Wilton <racingsnake(a)fastmail.fm> wrote:+1 Ian Glazer and I wrote about this in our Gartner days (so the results are hidden behind the Gartner paywall, regrettably...). However, a similar discussion surfaced at the ethical data-handling workshop I ran last Friday, and we distinguished between the following layers: - Privacy policy statement ( = privacy notice, as defined here); the outward facing doc saying what you want customers to hear.- Privacy policy: the internal statement of what the organisation thinks it should do- Business process: the internal statement of what the organisation thinks it does- Actual behaviour RRobin Wilton+44 (0)705 005 2931 -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

10 Sovereign Technology Components
by Adrian Gropper 05 May '16

05 May '16

https://docs.google.com/document/d/1q5BGr4THTPai-PKJLZ0_N1ZTsKDzBD795XPicCQ… is a short, editable document that attempts to define a sovereign technology based on work at this IIW. Blockchain, UMA, and FIDO can all be combined and understood as enablers of totally decentralized systems with no privacy policies or institutional contracts required. This paper that Doc pointed out http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2744751 introduces the case for sovereign technology today: > "The basic economics of blockchain can be thought of the case for why > decentralized solutions to ledgers, now technically possible, are likely to > become increasingly cost effective compared to centralized solutions as > they run down three exponential cost curves: (1) Moore’s law (cost of > processing digital information, i.e. speed, halves every 18 months); (2) Kryder’s > Law (cost of storing digital information, i.e. memory, halves every 12 > months); and (3) Nielsen’s Law (cost of shipping digital information, > i.e. bandwidth, halves every 24 months) (Wiles 2015)" > All of us as individuals can now own sovereign technology if we want to. The only question is how much of our budget should be dedicated to sovereign technology. My interest is primarily around decision support for health, but this could just as well include VRM and advertising in general. A small investment in sovereign technology allows one to leverage a huge market impact on decision support services. A sovereign technology perspective helps inform our work on standards as well as privacy. It offers a new perspective on services that ask for prior consent as an alternative to respect for our technology as our agent in their data use and sharing transactions. Accounting for the 10 sovereign technology components enables us to apportion our technology budget appropriately and it makes it easier to interpret the privacy policies of the services we choose (or are forced) to grant access to our personal data. Please help improve this paper and suggest where we go from here. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

1 0

Privacy policy or privacy notice: what's the difference? | CIO
by John Wunderlich 05 May '16

05 May '16

Useful reading. I’ve written both privacy policies and those things on web sites ‘called’ privacy policies. They are infrequently the same thing. This piece captures the difference reasonably well. http://www.cio.com/article/3063601/privacy/privacy-policies-and-privacy-not… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0