Re: [OAUTH-WG] November Interim meeting on WebID/IsLoggedIn followup

[Sam Goto <[e-mail]>]

On Fri, Jan 22, 2021 at 11:30 AM Vittorio Bertocci <vittorio.bertocci=
[e-mail]> wrote:

> Dear all,
>
> This is a followup on the actions we agreed upon during the November
> interim meeting in November (notes in
> https://datatracker.ietf.org/meeting/interim-2020-oauth-12/materials/minutes-interim-2020-oauth-12-202011021200-00).
> Apologies for the delay.
>
> The TL;DR is that we decided it might be useful to put together a document
> that describes the identity scenarios relying on current browser features
> and that we’d like to preserve.
>
> Such document should help grounding discussions with browser vendors by
> making it easy to pinpoint how specific changes might impair functionality
> in important scenarios, and what functionality we are trying to preserve
> (in case the new browser feature can offer alternate path to the same
> outcomes).
>
>
>
> Tackling on all the possible scenarios is too big a task for George and
> myself alone, hence we devised a proposed mechanism to generate and
> maintain that list collaboratively.
>
> You can find a framing proposal in
> https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00,
> and the github repo workspace https://github.com/IDBrowserUseCases/docs.
> Thanks to Daniel and Torsten for their help on figuring out how to use
> mmark to write internet drafts.
>
>
>
> We do have a list of candidate scenarios, but before going too deep in it
> we wanted to give the group the chance to take a look at the model and get
> your feedback before we charge down that path. This is a pretty unusual
> collaboration model and getting it to work might be tricky.
>
> Please let us know what you think!
>

Thanks Vittorio for kicking this off and I just wanted to stop by and say
that this seems like a wonderful starting point. I read your introduction
(which I think has done a great job in capturing the intent), your
template, and your initial test use case and I think this is a great
starting point.

More specifically:

- I really like how you are positioning this effort.
- I really like the section on scoping
<https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00#section-1.1>,
primarily on what not to cover: any scenario not currently in mainstream. I
know this is an over categorization, and I don't believe this was your
intent, but just for clarification, we would welcome scenarios under
"consumers" , "EDU" in addition to "enterprises" (I get the irony of the
section above "classifying most other cases as enterprise use cases hence
solvable by exceptions and local business policies" -- point taken).
- The template
<https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00#section-4>
LGTM. There is a chance it will evolve as we write more and we read more,
but this is a good starting point. Here are a few ways that I think this
could evolve:
  - perhaps a section with "Possible
technologies/announcements/APIs/features that may pose a risk to this
scenario" would be constructive to indicate "X (use case) breaks with Y
(browser API)".
  - I have a sense that we would want to extend/break down "Privacy
Considerations". One way to make this more concrete, is possibly to
cross-reference one of the privacy threat models (e.g. ours is here: Privacy
Threat Model
<https://github.com/WICG/WebID/blob/master/privacy_threat_model.md>) so
that we can collect something like "X (use case) conflicts with Y (privacy
threat)". Cross-referencing the threat model will also be useful in giving
you a sense of the threats we are set to address too.

I'll be watching the repository and looking forward to hearing from you,

Thanks again,

Sam


>
> Cheers
>
> G&V
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>