Re: [WG-UMA] AEMS in less than 300 words
Igor,
Interesting idea for AEMS implementation. Wondering if you have done threat modeling on this architecture. I see a lot of potential attack vectors that might break the protocol.
One concern is that the policy is separate from the email, so enforcement must be coded in the exchange protocol, which might not work as intended.
Regards,
ilyah
-----Original Message-----
From: WG-UMA
Hi ilyah,
You're right, there might be the potential threat vectors that could be
exploited by bad actors. I've been working on a proof-of-concept project
for the last few months and I do see room for improvement. For example, the
use of an authorization code in the authorization email. This will be part
of future work.
Regards
-Igor
On Thu, Feb 25, 2021 at 6:03 PM Ilyah Simuni
Igor, Interesting idea for AEMS implementation. Wondering if you have done threat modeling on this architecture. I see a lot of potential attack vectors that might break the protocol. One concern is that the policy is separate from the email, so enforcement must be coded in the exchange protocol, which might not work as intended.
Regards, ilyah
-----Original Message----- From: WG-UMA
On Behalf Of wg-uma-request@kantarainitiative.org Sent: Thursday, February 25, 2021 10:46 AM To: wg-uma@kantarainitiative.org Subject: WG-UMA Digest, Vol 140, Issue 13 Send WG-UMA mailing list submissions to wg-uma@kantarainitiative.org
To subscribe or unsubscribe via the World Wide Web, visit https://kantarainitiative.org/mailman/listinfo/wg-uma or, via email, send a message with subject or body 'help' to wg-uma-request@kantarainitiative.org
You can reach the person managing the list at wg-uma-owner@kantarainitiative.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of WG-UMA digest..."
Today's Topics:
1. Agenda for UMA telecon 2021-02-25 (Alec Laws) 2. AEMS in less than 300 words (Igor Zboran)
----------------------------------------------------------------------
Message: 1 Date: Thu, 25 Feb 2021 08:38:15 -0500 From: Alec Laws
To: "wg-uma@kantarainitiative.org WG" Subject: [WG-UMA] Agenda for UMA telecon 2021-02-25 Message-ID: Content-Type: text/plain; charset="us-ascii" https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25
UMA telecon 2021-02-25 Date and Time Alternate-week Thursdays 10:00am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 < https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&sa=D&ust=1587939127766000&usg=AOvVaw0IKJhMu1jFQF_dSO_5fyK-
United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar < http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11>, UMA telecon 2021-02-18 < https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18
Pensions Dashboard, any updates UMA/Email proof-of-concept Profiles Discussion, relationship manager AOB
- Alec
participants (2)
-
Igor Zboran
-
Ilyah Simuni