Hi ilyah, You're right, there might be the potential threat vectors that could be exploited by bad actors. I've been working on a proof-of-concept project for the last few months and I do see room for improvement. For example, the use of an authorization code in the authorization email. This will be part of future work. Regards -Igor On Thu, Feb 25, 2021 at 6:03 PM Ilyah Simuni <ilyah.simuni@ey.com> wrote:
Igor, Interesting idea for AEMS implementation. Wondering if you have done threat modeling on this architecture. I see a lot of potential attack vectors that might break the protocol. One concern is that the policy is separate from the email, so enforcement must be coded in the exchange protocol, which might not work as intended.
Regards, ilyah
-----Original Message----- From: WG-UMA <wg-uma-bounces@kantarainitiative.org> On Behalf Of wg-uma-request@kantarainitiative.org Sent: Thursday, February 25, 2021 10:46 AM To: wg-uma@kantarainitiative.org Subject: WG-UMA Digest, Vol 140, Issue 13
Send WG-UMA mailing list submissions to wg-uma@kantarainitiative.org
To subscribe or unsubscribe via the World Wide Web, visit https://kantarainitiative.org/mailman/listinfo/wg-uma or, via email, send a message with subject or body 'help' to wg-uma-request@kantarainitiative.org
You can reach the person managing the list at wg-uma-owner@kantarainitiative.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of WG-UMA digest..."
Today's Topics:
1. Agenda for UMA telecon 2021-02-25 (Alec Laws) 2. AEMS in less than 300 words (Igor Zboran)
----------------------------------------------------------------------
Message: 1 Date: Thu, 25 Feb 2021 08:38:15 -0500 From: Alec Laws <malcolm.laws@gmail.com> To: "wg-uma@kantarainitiative.org WG" <wg-uma@kantarainitiative.org> Subject: [WG-UMA] Agenda for UMA telecon 2021-02-25 Message-ID: <DD680E9B-5818-4335-AAC1-D970D34D4233@gmail.com> Content-Type: text/plain; charset="us-ascii"
https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25
UMA telecon 2021-02-25 Date and Time Alternate-week Thursdays 10:00am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 < https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&sa=D&ust=1587939127766000&usg=AOvVaw0IKJhMu1jFQF_dSO_5fyK-
United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar < http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11>, UMA telecon 2021-02-18 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18
Pensions Dashboard, any updates UMA/Email proof-of-concept Profiles Discussion, relationship manager AOB
- Alec