- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] Updating to UMA 2.0
by Mike Schwartz 10 Jun '17

10 Jun '17

Can you use the UMA grant to protect Userinfo? I had this same thought a year back. But if you don this, I think it's some other identity API. - Mike

1 0

Notes from Legal telecon 2017-06-09
by Eve Maler 09 Jun '17

09 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-06-09 - Reviewing pieces of deliverable #3 Attending: Eve, Colin, Tim, John W, Mark L, Kathleen The new matrix maps UMA consent licenses to key concepts in various regulatory regimes. How can we vet the correspondences? Can we see UMA as another chapter in the millennia-old commercial legal system? "Open" licenses are freely transferrable. "Limited" licenses limit the use to one specific user. Tim threw in duration as well, under "Non-Transferable". John points out that stopping the usage at one stop could be problematic because then a data controller couldn't ever go on and share with a data processor. Scenario: RO Alice chooses to share certain files (say, scanned receipts) from digital file system service Dropbox (an RS) to accountant (RqP) Bob, where Bob is using client app TurboTax. (Alice also happens to use TurboTax sometimes.) Alice's AS is ShareHub. Eve's question is: Is Bob a Data Processor? Or is Bob another Data Controller? Could there be different licenses for either circumstance? Regarding our artifacts: - The PAT (where Alice's AS and RS, ShareHub and Dropbox in this case, get associated together) is an OAuth access token, so it's an *opt-in flow* where Alice (typically) has no choice about the terms. The reason this may matter is that we might have limited ability to affect *OAuth's* parameters of a "legal framework", vs. UMA's. - On the other hand, the RPT (where Alice's policy conditions dictate the specific permissions and their durations) has a more discretionary nature. She has choice and control, to the extent of the AS's policy condition capabilities. (Those capabilities are in the "competitive space". See UMA Grant Sec 3.3.4 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html#autho…>, second Note text. This allows AS's to compete on policy condition handling.) - The PCT probably doesn't have any of the same categories that the PAT and RPT have. It's a simple token, actually a OAuth-like, which would have different rows. Is there *always*, *sometimes*, or *never* a transfer of accountability where the RqP becomes another Data Controller? The use cases we collected earlier, to her mind, seem to include both kinds. Mark brings up the case of consenting to sharing data for marketing purposes in this context. Kathleen thinks consumers won't get subtleties (and Eve agrees). Getting alerts would be a good pattern in case of concerns. So, apparently, our analysis seems to hold! We'd like to vet all this against the columns of the matrix. ("Consumer Data" refers to the body of commercial law.) Including the parental consent pattern would be good as well; it doesn't have to be specific to any one law/regulation. - Our presumption is that UMA is about the Resource Server Operator being a Data Controller serving the Data/Resource Subject (under some complex regime of the Data/Resource Subject's proxy, the Resource Owner, and their agent, the Authorization Server Operator). - We think we have to cover both "sharing with/delegating access to" a Data Processor (someone with limited accountability/responsibility/liability because they're getting access under your control) and another Data Controller (someone with full accountability/responsibility/liability because they're getting access on their own recognizance). We assume that AS and RS competition on interfaces for policy, resource types, etc. will need to ease paths for resource owners who interact with them. Kathleen asks: How to distinguish a license from a contract? Traditionally, a data subject isn't really given the opportunity to control what's done with their data. Eve: A license is a kind of contract/agreement, right? Mark notes that the CIS group today did a lot of great work around the FIPPS. They stress "...with the consent of the data subject". Discussion ensued about the role of the original principles, further operationalization in the DPD and then the GDPR, and the concurrent rise of the OAuth, OIDC, and UMA stack and Consent Receipts. We also discussed the Brave Browser <https://brave.com/> and their recent huge round of funding <https://techcrunch.com/2017/06/01/brave-ico-35-million-30-seconds-brendan-e…> . Kathleen provides a link to a presentation from HIMSS <http://wiki.hl7.org/index.php?title=HIMSS_2017_Patient_Choice> about VA and UMA. *AI:* Eve: Send out links to the current state of the (old) Binding Obligations and (newer) CommonAccord model clause text, which was intended to fill in PAT and RPT license text (and on and on), respectively. *AI:* Eve and Tim: Meet briefly to brainstorm what rows the PCT would have, and external experts to reach out to. *AI:* John, Mark, Kathleen: Review the X's in the cells of the matrix. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: Legal call is still on for tomorrow
by Eve Maler 08 Jun '17

08 Jun '17

We'll have a new interim chart to examine on the way to deliverable #3. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

No UMA WG call this Thursday again
by Eve Maler 07 Jun '17

07 Jun '17

But we should probably have a quick check-in meeting next week, so please plan on that. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

New paper on Identity, Data and next-gen Federation
by Thomas Hardjono 06 Jun '17

06 Jun '17

Eve, Mark, UMA folks, This new paper (PDF) might be of some use in framing-up the next level of discussions regarding "identity" and "data" and how to"federate data". Its permanent link is here: http://arxiv.org/abs/1705.10880 I'm thinking that the Claims-gathering flows in UMA and also the Consent-Receipts flows could use an "algorithm-identifier" value, effectively stating that "Alice consents to Algorithms X be run against her data set Y" (where the data-set lies in her private Resource Server). Best. /thomas/

9 22

Digital Privacy Is Making Antitrust Exciting Again
by John Wunderlich 06 Jun '17

06 Jun '17

https://www.wired.com/2017/06/ntitrust-watchdogs-eye-big-techs-monopoly-dat… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

required claims definition: array of object?
by Mike Schwartz 04 Jun '17

04 Jun '17

Another editorial suggestion... https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-04.html#autho… required_claims "An array containing parameters that describe the required claims, with the following subparameters:" Is parameters the right word there? Would objects be better? Maybe something like: required_claims "An array containing objects that describe the required claims, with the following keys." - Mike

4 3

OT: Funny
by Eve Maler 02 Jun '17

02 Jun '17

My company uses Expensify, and apparently they added a new delegated access feature (that I haven't seen or used yet) that sounds pretty UMA-ish. Wonder how much it cost them to implement it from scratch. Anyway, the CEO sends out these chatty newsletters, and the latest one included this blurb: "*2) "Wingman" renamed to "Copilot"* Remember how we had the genius idea of naming our amazing delegated access feature (where one user can sign in to another's account to help them out) "Wingman"? As a child of the 80's I just assumed that name conjured up images of Top Gun fighter jets and double high-fives in everyone. But it turns out that to the children of the 90's and beyond, it means cruising bars and picking up chicks -- who knew? Actually, almost everyone it seems. So, bowing to the wisdom of the crowd, "Wingman" is now the less-offensively named "Copilot". My bad!" Still laughing... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Fwd: Register Now for SOUPS 2017!
by Eve Maler 01 Jun '17

01 Jun '17

Wish I could attend this one, but for anyone else who is interested... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mary Ellen Zurko <maryellen.zurko(a)usenix.org> Date: Mon, May 8, 2017 at 5:40 PM Subject: Register Now for SOUPS 2017! To: "eve(a)xmlgrrl.com" <eve(a)xmlgrrl.com> [image: SOUPS 2017, July 12–14, 2017, Santa Clara, CA, USA] <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_0/1?…> Greetings, Please join us in Santa Clara, CA, on July 12–14, 2017, for the Thirteenth Symposium on Usable Privacy and Security. SOUPS 2017 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_1/1?…> will bring together an interdisciplinary group of researchers and practitioners in human computer interaction, security, and privacy. Register <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct1_0/1?…> by Monday, June 19, to take advantage of the early bird registration discount. The hotel reservation discount deadline is also June 19, so book your room today <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct2_0/1?…> . SOUPS 2017 will feature technical papers, a poster session, panels and invited talks, lightning talks and demos, and workshops and tutorials. The full program will be available in June. See the list of open calls <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct3_0/1?…> below: - Call for Lightning Talks and Demos <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct4_0/1?…> Early submissions deadline: Monday, May 22 - Call for Papers: 2nd Workshop on Inclusive Privacy and Security (WIPS 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct5_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: 3rd Workshop on Security Information Workers (WSIW 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct6_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: Who Are You?! Adventures in Authentication (WAY 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct7_0/1?…> Submissions deadline: Thursday, May 25 - Call for Posters <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct8_0/1?…> Submissions deadline: Monday, May 29 SOUPS 2017 is co-located with USENIX ATC '17 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct9_0/1?…> . We look forward to seeing you in Santa Clara! Mary Ellen Zurko SOUPS 2017 General Chair soups17chair(a)usenix.org For more information and frequent updates regarding SOUPS, please check out our Facebook page <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct10_0/1…> . Please use soups17chair(a)usenix.org to contact Mary Ellen Zurko. The email address maryellen.zurko(a)usenix.org is for automated list management only. About this mailing list: USENIX never shares, sells, rents, or exchanges email addresses of its members or conference attendees. We would like to continue sending you occasional email announcements like this one. However, if you no longer want to receive emails from USENIX, please click here <http://s.usenix.org/acton/rif/2452/s-0209-1705/-/l-1bc7:db/l-1bc7/zout?sid=…> to opt out. If you have any questions about the mailing list, please email office(a)usenix.org. We may also be reached via postal mail at: USENIX Association 2560 Ninth St, Suite 215, Berkeley, CA 94710, USA

1 0

Actually, Legal call canceled this week -- next Legal call is on Friday, June 9th
by Eve Maler 01 Jun '17

01 Jun '17

Talk to you then! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0