Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56335C14F616 for ; Tue, 24 Dec 2024 10:17:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_FACE_BAD=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Th6mlM2wB6A3 for ; Tue, 24 Dec 2024 10:17:14 -0800 (PST) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D958C14F604 for ; Tue, 24 Dec 2024 10:17:14 -0800 (PST) Received: by mail-lf1-x133.google.com with SMTP id 2adb3069b0e04-5401ab97206so5450999e87.3 for ; Tue, 24 Dec 2024 10:17:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1735064232; x=1735669032; darn=ietf.org; h=cc:to:subject:message-id:date:from:reply-to:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=YmcCGB7s4wuFk03HFSGLDFc28ykI4kQqQy+kRZqff+w=; b=ciH9mIS720wLL54pi+lsfcYU2tPKSJ95MVbR1Ub3+lUOKW/cfh/BGgy5OxRU4QqTfA ycWR0ITrlygurOXHeyuTUBeqAf1KWt3SJxuSVERR4tBEP4fMvLtD6S9BwYQU5NFHVMfe udP3PP8UwIMPfb2kV7c9WZZPJqxgUYYEKJiZqf/49o369b3uzq0I5RL8Xvs7A/UbRYfj Yo4tzyLDt+Mn0mBEPOXx8DhczmDKI5osjfnWzMct8apLd7WhJ7EPgk0tjmQ3af2SlvQE TqIsXbCUAbPCROjEPyl9Z97EF1+NjnYfhyH8cMUww5nDaIVDv14IMnckhO/mNLlBD0Fm hz9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1735064232; x=1735669032; h=cc:to:subject:message-id:date:from:reply-to:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=YmcCGB7s4wuFk03HFSGLDFc28ykI4kQqQy+kRZqff+w=; b=Ltchq2JmQhc/AavDcCku4DfTg06A3XiRGx1jB89+KxlM5EmhznPiLtNSRDr88WAa2l pgsDnB4SwTsOsKOEHgqPE/DEH4/cmFMnjF0SQu3q13MJEvdYR+6GazLYSEsQijHxgAYZ 0WkQH6UkE8+QbnXnpmlIX7HXgqzl6XTaxElXMLo+Tl6eBfSLL1Ta5DZQGEtymOS4m0Wm 8m2ROLUgCDSMldfD3Uc/0OUwyneypG8vNcUvv8cJtBDnzLNVGk+gj5O75QiLIWvtjPlm zjqsgptGo9ELfh1D2b4VZw5AlruAIE4av1o9Ym4nknUtuDZ5LcBq6x33+xB7efHFygE3 qkIg== X-Forwarded-Encrypted: i=1; AJvYcCXj9qIuyr4ciuJY3LUHTAGBM+AppTbMlGKvh3je8BeN4WSE5oVgBZ3nrkIhdOMHmx1B1wiDsA==@ietf.org X-Gm-Message-State: AOJu0YyJJ/87qrraoFl7q3NCc5ejWlGW+Up5ZxyywawxWI9FUBZeFM59 C20RYcvjdm5TcOaXD/s9epbd00CqahXC1FPZzrB9JuxMmEoaVcofYh/yw8F0lRa/Nf5O+Y97kX6 ZehlkAomXXKjWmYKZJK/6yi7e9Ap1/A== X-Gm-Gg: ASbGncsGLTwCR+ldak3NVx+WdRvM81DRmSiYDY1ZvpcLncCrOCBSvQE6z1MDoyVXWC0 IirhsrMth8ZaPeSfc07rjHAdY2Ze4952LNAfTDIffdPeRJ0VtOvXVMHAKZxDj782ZppuDhkE= X-Google-Smtp-Source: AGHT+IHKF+neY4pIJz5tOV019pT9nn6wddTOhxt/Bd7bOXBl2EjMRIyOpGDPyhvalaauxYw1HHWcNiQvuHmTF3chHaQ= X-Received: by 2002:a05:6512:b0f:b0:542:223f:f62c with SMTP id 2adb3069b0e04-5422953d2d5mr6374040e87.22.1735064231485; Tue, 24 Dec 2024 10:17:11 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Tom Jones Date: Tue, 24 Dec 2024 10:16:59 -0800 Message-ID: To: Wayne Chang Content-Type: multipart/alternative; boundary="0000000000002e2dc7062a081f8e" Message-ID-Hash: P4DP3SDFH6W34I5UXFN42IBMV6DXSKHV X-Message-ID-Hash: P4DP3SDFH6W34I5UXFN42IBMV6DXSKHV X-MailFrom: thomasclinganjones@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: peace@acm.org, John Wunderlich , IETF oauth WG X-Mailman-Version: 3.3.9rc6 Precedence: list Reply-To: peace@acm.org Subject: =?utf-8?q?=5BOAUTH-WG=5D_Re=3A_Alternative_text_for_sd-jwt_privacy_considera?= =?utf-8?q?tions=2E?= List-Id: OAUTH WG Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --0000000000002e2dc7062a081f8e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable if by ID you mean ID number - then it is a tracking number. Isn't it super obvious - why are we pretending to be privacy enabling? Peace ..tom jones On Tue, Dec 24, 2024 at 10:15=E2=80=AFAM Wayne Chang w= rote: > Tom, how do you feel about private sector issued ID? > > Best, > Wayne Chang > Founder & CEO | SpruceID | LinkedIn > > > > On Wed, Dec 25, 2024 at 02:04 Tom Jones > wrote: > >> While Waton's statement is correct - it does not address the core proble= m >> with any credential that comes with an ID. >> >> All reusable IDs enable tracking. Full Stop. >> All government issued ID enable tracking. Just like social insurance >> number or any other cred. >> So - if you want privacy - don't release the ID number. >> >> Peace ..tom jones >> >> >> On Tue, Dec 24, 2024 at 6:34=E2=80=AFAM Watson Ladd >> wrote: >> >>> I see that people are uncomfortable with making any mandates, and so >>> I've tried to be purely descriptive in this proposal. I leave it to the= WG >>> to decide where to put it, but I see it as a wholesale replacement for = some >>> sections to emphasize clarity. >>> >>> "SD-JWT conceals only the values that aren't revealed. It does not mee= t >>> standard security notations for anonymous credentials. In particular >>> Verifiers and Issuers can know when they have seen the same credential = no >>> matter what fields have been opened, even none of them. This behavior m= ay >>> not accord with what users naively expect or are lead to expect from UX >>> interactions and lead to them make choices they would not otherwise mak= e. >>> Workarounds such as issuing multiple credentials at once and using them >>> only one time can help for keeping Verifiers from linking different >>> showing, but cannot work for Issuers. This issue applies to all selecti= ve >>> disclosure based approaches, including mdoc. " >>> >>> Sincerely, >>> Watson >>> _______________________________________________ >>> OAuth mailing list -- oauth@ietf.org >>> To unsubscribe send an email to oauth-leave@ietf.org >>> >> _______________________________________________ >> OAuth mailing list -- oauth@ietf.org >> To unsubscribe send an email to oauth-leave@ietf.org >> > _______________________________________________ > OAuth mailing list -- oauth@ietf.org > To unsubscribe send an email to oauth-leave@ietf.org > --0000000000002e2dc7062a081f8e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
if by ID you mean ID number - then it is a tracking n= umber.
Isn't it super obvious - why are we pretending to be p= rivacy enabling?

Peace ..tom jones

=
On Tue, Dec 24, 2024 at 10:15=E2=80=AFAM Wayne Chang <wayne@spruceid.com> wrote:
Tom= , how do you feel about private sector issued ID?

= Best,
Wayne Chang
Founder & CEO | SpruceID=C2=A0| LinkedIn
=


On Wed, Dec 25, 2024 at 02:04 Tom Jones <thomasclinganj= ones@gmail.com> wrote:
While Waton's statement is correct = - it does not address the core problem with any credential that comes with = an ID.

All reusable IDs enable tracking.=C2=A0 Ful= l Stop.
All government issued ID enable tracking. Just like socia= l insurance number or any other=C2=A0cred.
So - if you want priva= cy - don't release the ID number.

Peace ..tom jones


On Tue, Dec 24, = 2024 at 6:34=E2=80=AFAM Watson Ladd <watsonbladd@gmail.com> wrote:
I see th= at people are uncomfortable with making any mandates, and so I've tried= to be purely descriptive in this proposal. I leave it to the WG to decide = where to put it, but I see it as a wholesale replacement for some sections = to emphasize clarity.

=C2=A0"SD-JWT conceals = only the values that aren't revealed. It does not meet standard securit= y notations for anonymous credentials. In particular Verifiers and Issuers = can know when they have seen the same credential no matter what fields have= been opened, even none of them. This behavior may not accord with what use= rs naively expect or are lead to expect from UX interactions and lead to th= em make choices they would not otherwise make. Workarounds such as issuing = multiple credentials at once and using them only one time can help for keep= ing Verifiers from linking different showing, but cannot work for Issuers. = This issue applies to all selective disclosure based approaches, including = mdoc. "

Sincerely,
Watson
_______________________________________________
OAuth mailing list -- o= auth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org
_______________________________________________
OAuth mailing list -- o= auth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org
_______________________________________________
OAuth mailing list -- o= auth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org
--0000000000002e2dc7062a081f8e--