Re: [Last-Call] [OAUTH-WG] Last Call: <draft-ietf-oauth-jwt-introspection-response-09.txt> (JWT Response for OAuth Token Introspection) to Proposed Standard

I would argue that by the nature of OAuth tokens not being bound to user presence or sessions, it’s not an indication that the user is present necessarily, unless you know something additional about the nature of the client. But it does tell the AS when the client is active for a particular AS, which in some cases is a privacy concern and in others it’s a signal into the AS for keeping an eye out for aberrant behavior that a single RS couldn’t detect.

This is all a general implication of the introspection process, and not unique to this draft. That said, it’s an aspect of privacy that we did not cover in the considerations for RFC7662, but I don’t know if it’s appropriate to add such a general consideration here.

 — Justin

> On Aug 26, 2020, at 12:52 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
> 
> 
> 
> On Wed, Aug 26, 2020 at 4:37 AM Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org <mailto:40lodderstedt.net@dmarc.ietf..org>> wrote:
> Hi Denis,
> 
> > On 25. Aug 2020, at 16:55, Denis <denis.ietf@free.fr <mailto:denis.ietf@free..fr>> wrote:
> 
> > The fact that the AS will know exactly when the introspection call has been made and thus be able to make sure which client 
> > has attempted perform an access to that RS and at which instant of time. The use of this call allows an AS to track where and when 
> > its clients have indeed presented an issued access token.
> 
> That is a fact. I don’t think it is an issue per se. Please explain the privacy implications. 
> 
> As I see it, the privacy implication is that the AS knows when the client (and potentially the user) is accessing the RS, which is also an indication of when the user is using the client.
> 
> I think including this implication would be important to have in a Privacy Considerations section.
> 
> /Dick
> ᐧ
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth