- WG-UMA - mailman.kantarainitiative.org

Digital Privacy Is Making Antitrust Exciting Again
by John Wunderlich 06 Jun '17

06 Jun '17

https://www.wired.com/2017/06/ntitrust-watchdogs-eye-big-techs-monopoly-dat… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

required claims definition: array of object?
by Mike Schwartz 04 Jun '17

04 Jun '17

Another editorial suggestion... https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-04.html#autho… required_claims "An array containing parameters that describe the required claims, with the following subparameters:" Is parameters the right word there? Would objects be better? Maybe something like: required_claims "An array containing objects that describe the required claims, with the following keys." - Mike

4 3

OT: Funny
by Eve Maler 03 Jun '17

03 Jun '17

My company uses Expensify, and apparently they added a new delegated access feature (that I haven't seen or used yet) that sounds pretty UMA-ish. Wonder how much it cost them to implement it from scratch. Anyway, the CEO sends out these chatty newsletters, and the latest one included this blurb: "*2) "Wingman" renamed to "Copilot"* Remember how we had the genius idea of naming our amazing delegated access feature (where one user can sign in to another's account to help them out) "Wingman"? As a child of the 80's I just assumed that name conjured up images of Top Gun fighter jets and double high-fives in everyone. But it turns out that to the children of the 90's and beyond, it means cruising bars and picking up chicks -- who knew? Actually, almost everyone it seems. So, bowing to the wisdom of the crowd, "Wingman" is now the less-offensively named "Copilot". My bad!" Still laughing... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Fwd: Register Now for SOUPS 2017!
by Eve Maler 02 Jun '17

02 Jun '17

Wish I could attend this one, but for anyone else who is interested... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mary Ellen Zurko <maryellen.zurko(a)usenix.org> Date: Mon, May 8, 2017 at 5:40 PM Subject: Register Now for SOUPS 2017! To: "eve(a)xmlgrrl.com" <eve(a)xmlgrrl.com> [image: SOUPS 2017, July 12–14, 2017, Santa Clara, CA, USA] <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_0/1?…> Greetings, Please join us in Santa Clara, CA, on July 12–14, 2017, for the Thirteenth Symposium on Usable Privacy and Security. SOUPS 2017 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_1/1?…> will bring together an interdisciplinary group of researchers and practitioners in human computer interaction, security, and privacy. Register <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct1_0/1?…> by Monday, June 19, to take advantage of the early bird registration discount. The hotel reservation discount deadline is also June 19, so book your room today <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct2_0/1?…> . SOUPS 2017 will feature technical papers, a poster session, panels and invited talks, lightning talks and demos, and workshops and tutorials. The full program will be available in June. See the list of open calls <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct3_0/1?…> below: - Call for Lightning Talks and Demos <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct4_0/1?…> Early submissions deadline: Monday, May 22 - Call for Papers: 2nd Workshop on Inclusive Privacy and Security (WIPS 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct5_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: 3rd Workshop on Security Information Workers (WSIW 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct6_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: Who Are You?! Adventures in Authentication (WAY 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct7_0/1?…> Submissions deadline: Thursday, May 25 - Call for Posters <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct8_0/1?…> Submissions deadline: Monday, May 29 SOUPS 2017 is co-located with USENIX ATC '17 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct9_0/1?…> . We look forward to seeing you in Santa Clara! Mary Ellen Zurko SOUPS 2017 General Chair soups17chair(a)usenix.org For more information and frequent updates regarding SOUPS, please check out our Facebook page <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct10_0/1…> . Please use soups17chair(a)usenix.org to contact Mary Ellen Zurko. The email address maryellen.zurko(a)usenix.org is for automated list management only. About this mailing list: USENIX never shares, sells, rents, or exchanges email addresses of its members or conference attendees. We would like to continue sending you occasional email announcements like this one. However, if you no longer want to receive emails from USENIX, please click here <http://s.usenix.org/acton/rif/2452/s-0209-1705/-/l-1bc7:db/l-1bc7/zout?sid=…> to opt out. If you have any questions about the mailing list, please email office(a)usenix.org. We may also be reached via postal mail at: USENIX Association 2560 Ninth St, Suite 215, Berkeley, CA 94710, USA

1 0

Actually, Legal call canceled this week -- next Legal call is on Friday, June 9th
by Eve Maler 01 Jun '17

01 Jun '17

Talk to you then! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

No WG call on Thursday; Legal call is still on for Friday; offline tasks
by Eve Maler 31 May '17

31 May '17

Enjoy the time off on Thursday. I've updated the swimlane and linked it from the home page, but haven't yet broken it up to reflect the Grant/FedAuthz distinction -- which would probably necessitate breaking it up into two. Anyone interested to contribute to the Release Notes with me? Any additional suggestions for UIG topics? Here are our Wikipedia pages: https://en.wikipedia.org/wiki/User-Managed_Access https://de.wikipedia.org/wiki/User-Managed_Access https://es.wikipedia.org/wiki/User-Managed_Access https://fr.wikipedia.org/wiki/User-Managed_Access https://it.wikipedia.org/wiki/User-Managed_Access Domenico had offered to update the Italian one (thanks!). Other offers?... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED)
by Eve Maler 29 May '17

29 May '17

Note that the close of the comment period is now July 12. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Kantara Initiative <staff(a)kantarainitiative.org> Date: Sun, May 28, 2017 at 3:06 PM Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED) To: announcements(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: *2017-07-12* at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> Click here to unsubscribe: http://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Glossary?
by Mike Schwartz 28 May '17

28 May '17

Eve, Just an editorial note: In UMA Grant, there is a glossary in section 1.3 (Abstract Flow). It says "Following are key concepts relevant to this specification," but it doesn't jump out at you. I was looking for a glossary in the TOC, and couldn't find it. And then in UMA Federated Authz, there is no glossary. You could perhaps reference the Glossary from Federated Authz to UMA Grant, but some of the definitions maybe needs to be tweaked. For example, I was looking at the definition of permission ticket: "A correlation handle, initially passed to the client by the resource server" That makes sense for UMA grant, but for federated Authz, it probably makes sense to mention the AS. - Mike

2 4

Notes from UMA Legal telecon 2017-05-26
by Eve Maler 26 May '17

26 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-05-26 - Reviewing deliverable #2 Attending: Eve, JohnW, Kathleen, Tim, Andrew, Scott D, Mark L Eve shared the experience of presenting to the Cloud, Big Data, and AI legal conference on May 23. She got to try out the elevator pitch for our nascent legal framework and the rest of the work. She'll point to the PDF of her slides when available. The first key element of this deliverable, as discussed previously, is the conceptual orange/blue chart. Communications are required in an electronic protocol context. The Communication/Autonomy nexus includes Consent(Autonomy/Law), Sharing(Autonomy/Commerce), and Protocols(Autonomy/Communication). Scott notes: "Consciousness" as part of this might sound "frilly", but as part of law it's actually not – it's a "meeting of the minds", so it's fundamental to contract formation. There are famous cases every law student learns regarding this concept. John comments, channelling Doc regarding contracts of adhesion: How does this play in? The problem of the human mind and questions of human authority are fundamental. We ultimately have to map UMA to law. Eve: Going by the matrix, this looks like Consent (Law/Autonomy), Access Authorization (Law/Reciprocity), License (Law/Objectivity). Reciprocity supports enforceability of transactions. How do we get to a grant of access rights? UMA's permission tokens are an anchor. The word "delegation" from a legal perspective doesn't make sense, quite. Kathleen observes that DRM is a technology that is literally used to effect access licensing already. Is it possible to get to the point of breaking the law by accessing some digital resource? Who controls the access relationship? Any requirement for consent is a basis for the authority we are looking to ensconce. So the various regulations that strengthen consent requirements, such as PIPEDA, GDPR, PSD2, and others (such as "patient right of access", which is an "economic clout-oriented" strength, as Kathleen points out) strengthen our ability to make these connections. Eve thinks FIPPS is too "soft power", in that it needs to be operationalized through other regulatory structures. (Eve reminds us all to focus on the "hard power" we have, which is to develop the framework and toolkits to influence those actually deploying services. Our "soft power" to influence policymakers to make law and regulation is to be done only through the framework level as interesting written material, and through other means. That's why we don't have a Resource Regulator role formally.) Scott remarks that "consent" is sort of a legacy system that isn't fit for purpose, but is well understood. He also notes that the word "control" is a difficult one; a "co-management regime" over digital resources is a more realistic way of seeing the challenge. Kathleen points out that consumers have the power to fill their profiles with false information; she calls it discombobulation. Eve points to The Economics of Privacy <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2580411>, which provides evidence that savvy consumers can manipulate businesses/organizations, and that greater data sharing can benefit (e.g.) patients. Eve agrees about stepping back *two* steps from "data ownership": from "own", and again from "control", to "management". *Also* from "data" to "(digital) resource" (because sometimes the data is very transient, e.g. provided through a streaming API). Scott adds that a person's relationship to a thing should really be a relationship to another person vis a vis the thing. Eve wonders if we can publish a Talmudic-style commentary version of deliverable #2 (or turn all the deliverables into eventual WG deliverables, or whatever) for benefit of the wider audience we're going for. Scott notes that the UCC Commentary provides a potential model; it's citable. Mark notes that trade associations are trying to figure out how to develop codes of conduct that are GDPR-conforming. Eve points to A Typology of Privacy, and specifically its typology of the objects of the rights to privacy, as great additional commentary that could extend our analysis of Communication; it puts "mediated communication" under the "semi-privacy zone" (which came from Westin's work). John points further to the NIST Privacy Engineering <http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf> work; see page 17. Similar to the security concept of CIA, it proposes "predictability, manageability, and disassociability". Regarding the opportunities to combine forces and possibly have a KI-wide Legal WG that at least encompasses the scope of the current UMA Legal and CIS legal-related work: There's consent receipt lifecycles, User Submitted Terms as ready-made licensing terms, a CR version of the orange/blue matrix?, and possibly more. Eve noted that the current UMA Legal mission is very much like a charter. The French court had said it was a derogation of human rights to give too-broad permission. (And GDPR has now ensconced a requirement to give specific purpose of use!) So Scott had suggested at the legal conference that maybe it could be possible to delegate to a fiduciary layer some broad ability to manage permissions, and then that layer could give more reliability around this. This was the point at which Eve leaned over and whispered, "Like an authorization server?" [image: (smile)] (Or the authorization server operator, to be precise.) The theory Eve has had is that a Resource Owner (Grantor as was) and Authorization Server Operator should be able to negotiate the former delegating to the latter the ability not just to execute to the former's protection policies, but to set policies on their behalf, e.g. setting default policies. This is a real use case that has come up in HEART, and we have even defined one of the profiles to account for this. Tim says this is where the word *agent* comes in, so it should be covered. *Next steps:* Everyone to review the document as sent in email by next week for deliverable #3 purposes. *AI:* Eve: Review deliverable #2 for copy-editing/Kantara approval purposes ASAP. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Andrew Hughes 26 May '17

26 May '17

From: Megan Cannon <megan(a)kantarainitiative.org> Date: Fri, 26 May 2017 04:59:22 +0000 Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: 2017-07-09 at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo]

2 1