Re: [apps-discuss] Webfinger discussion

[SM <[e-mail]>]

At 12:32 27-03-2012, 'Andrew Sullivan' wrote:
>I wish I had something more intelligent to say than, "Is anyone [else]
>worried about the aggregation of this information amd what it does to
>the security profile of the aggregated things?"  Note this isn't

I'll label it as a concern.

>If I understood correctly, it seems to me that disclosing something
>about the relationship of these three accounts is in effect a new
>disclosure, and that it offers potential for analysis (and therefore
>attacks) that might not have been available given the individual
>accounts alone.  But beyond that hand-wavy unease, I haven't the tools

Yes.

>to say anything really sensible.  Maybe there's some sort of secdir
>guidance for this sort of thing?  (Note that I'm not a security guy,

That might be summed up as:

  "If one does not wish to share certain information with the world, do
   not allow that information to be accessible through Webfinger."

I suggest that the authors take a look at draft-iab-privacy-considerations-02.

Regards,
-sm