Re: [apps-discuss] webfinger privacy question/suggestion

It is probably up to the service to determine whether they return different information to an authenticated context.  Auth method and behavior is outsied the scope of WF I think.

>________________________________
> From: Paul E. Jones <paulej@packetizer.com>
>To: 'Hannes Tschofenig' <hannes.tschofenig@gmx.net>; 'Phillip Hallam-Baker' <hallam@gmail.com> 
>Cc: 'General discussion of application-layer protocols' <apps-discuss@ietf.org> 
>Sent: Wednesday, October 31, 2012 4:01 PM
>Subject: Re: [apps-discuss] webfinger privacy question/suggestion
> 
>Hannes,
>
>I'm not sure if it is possible to use OAuth with
>/.well-known/host-meta.json.
>
>Can OAuth be used to protect any resource on the Internet?  If so, it could
>be used to control access to /.well-known/host-meta.*.  For certain, all of
>the link relations provided could be protected with any authentication
>scheme.  Just because my WF server provides the link to my address book does
>not mean anyone would have authorization to retrieve it.
>
>Sometimes I wonder if people have forgotten or not considered that fact.
>Certain information is revealed just from the JRD document itself (e.g., the
>very fact I have some piece of data published), but the actual referenced
>document can be tightly controlled.
>
>Within a corporate environment, I would even expect an internal WF query to
>return different results than an external one.  That would not require
>OAuth, but would be controlled based on whatever mechanism is used to
>determine if a person has access rights as an employee.
>
>Paul
>
>> -----Original Message-----
>> From: apps-discuss-bounces@ietf.org [mailto:apps-discuss-
>> bounces@ietf.org] On Behalf Of Hannes Tschofenig
>> Sent: Wednesday, October 31, 2012 9:06 AM
>> To: Phillip Hallam-Baker
>> Cc: General discussion of application-layer protocols
>> Subject: Re: [apps-discuss] webfinger privacy question/suggestion
>> 
>> Hi Phillip,
>> 
>> On Oct 31, 2012, at 2:20 PM, Phillip Hallam-Baker wrote:
>> 
>> > Javascript which basically was designed by people who only cared about
>> goosing their stock options.
>> 
>> I do not disagree with you here but WebFinger by itself does not
>> necessarily need to be implemented in JavaScript(*).
>> 
>> > 'is Web finger helping people to do the sorts of things that users
>> want without unexpected privacy side effects'
>> 
>> There are use cases where people want to use WebFinger as a discovery
>> mechanism (such as OAuth) where the current design of WebFinger
>> introduces privacy problems (unnecessarily). I raised this issue last
>> year in May:
>> http://www.ietf.org/mail-archive/web/oauth/current/msg08965.html
>> 
>> It seems that WebFinger has become a solution in search of a problem for
>> some people.
>> 
>> Ciao
>> Hannes
>> 
>> PS: (*) In the context of the use case I care about (namely identity
>> management) implementations of JavaScript tend to have serious security
>> problems.
>> _______________________________________________
>> apps-discuss mailing list
>> apps-discuss@ietf.org
>> https://www.ietf.org/mailman/listinfo/apps-discuss
>
>_______________________________________________
>apps-discuss mailing list
>apps-discuss@ietf.org
>https://www.ietf.org/mailman/listinfo/apps-discuss
>
>
>