Re: [OAUTH-WG] Privacy Considerations section in OAuth 2.1?

Aaron Parecki <aaron@parecki.com> Mon, 10 August 2020 17:20 UTC

Return-Path: <aaron@parecki.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF663A0B21 for <oauth@ietfa.amsl.com>; Mon, 10 Aug 2020 10:20:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.995
X-Spam-Level:
X-Spam-Status: No, score=-0.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=parecki.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tn-uSZbek7rq for <oauth@ietfa.amsl.com>; Mon, 10 Aug 2020 10:20:41 -0700 (PDT)
Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B58193A0B4F for <oauth@ietf.org>; Mon, 10 Aug 2020 10:20:41 -0700 (PDT)
Received: by mail-io1-xd2e.google.com with SMTP id k23so9703903iom.10 for <oauth@ietf.org>; Mon, 10 Aug 2020 10:20:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=parecki.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=B4Elje0uXPXKSmbCK8AyL1qaJx4mVd7OzJmRi/MekXo=; b=YTEB3TMKxnimbzvVWONg/GFG8gmamGqYJAo0Fy2bK1HuBL6ZOjXdJLjGYI1WTlfam7 ugwFAuINQlLHBKfQXo4jtw4/doxYrRKcNF9KryWu2iVyKnWYtCdCQJNCWlPaaNiMFkSX lX+unBbaR0RtgTXUDIz9MEeRUgMW0o+ulAKAaMHSGk6rSKfL8EzvrP3sI4w/QYxONbpt Y8AmAI8TQ1kK4fhbYSCQ/dkVjfAyaTXzRyDkEj2QIBvsFKaJGq8iKKD9Ey69b0X/KN2x 60SIvLq1yjnOB7LcHCaMus3E3tQ0/2XZVFqLICaCt3hHwh8/P9jCG0uRqpKLX44ZEBDZ 3zJw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=B4Elje0uXPXKSmbCK8AyL1qaJx4mVd7OzJmRi/MekXo=; b=WeIs3K3dBdPJgTt2Xj8Wx/jsidpyFI68Lu7NtgilAKXHZYqdL/R9X7xWCX3DeuWu6+ QsBc7yhsxSTea0hArhHus3pjYRgK8KFojfPmmetS/ujEwfkFbEO24UdO7FZrs3Z305Q7 eCBjgaN5huyj/ososCekgqy2D7obqBFGVZZOaOLb+JzA1NY2SFKgJo0ndboL9DnpbPJa D6jPkNt12FKKpZCSPqwGzK9DWoaeKBUUev8nQ0mGKmNF37Qh6tqdfmfwjZHe03PCIAi4 oTCuE/cQV2V3L8E5IFEWtbU2jZ2SjdG3m9mPA9M9QSwrqXRZWm+CuR4YWQ7NecxRKBq2 sRRw==
X-Gm-Message-State: AOAM531wk3uTHr3C80l91GEArSi+WGZNYB5tvlpSkBRzXn/8iUBfPl3r srhEQTY5I7M5D6RGZMj9zVw/XAbdo14=
X-Google-Smtp-Source: ABdhPJxHaZVqvSiB5rp2GX/PTFO4aYwLqbDSVV84+Pm0FLBwq8DyFR/zsqfocQ2EcuHnx31LQyw5kA==
X-Received: by 2002:a05:6638:2164:: with SMTP id p4mr20688786jak.57.1597080040077; Mon, 10 Aug 2020 10:20:40 -0700 (PDT)
Received: from mail-il1-f169.google.com (mail-il1-f169.google.com. [209.85.166.169]) by smtp.gmail.com with ESMTPSA id l16sm6244318ilg.5.2020.08.10.10.20.38 for <oauth@ietf.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 10 Aug 2020 10:20:39 -0700 (PDT)
Received: by mail-il1-f169.google.com with SMTP id 77so8225284ilc.5 for <oauth@ietf.org>; Mon, 10 Aug 2020 10:20:38 -0700 (PDT)
X-Received: by 2002:a92:5bd5:: with SMTP id c82mr19185913ilg.166.1597080038736; Mon, 10 Aug 2020 10:20:38 -0700 (PDT)
MIME-Version: 1.0
References: <CAD9ie-uPT3Yp12gkkUaBEEwEc3P9uGdQpHTVPypf7gaescwKOw@mail.gmail.com>
In-Reply-To: <CAD9ie-uPT3Yp12gkkUaBEEwEc3P9uGdQpHTVPypf7gaescwKOw@mail.gmail.com>
From: Aaron Parecki <aaron@parecki.com>
Date: Mon, 10 Aug 2020 10:20:27 -0700
X-Gmail-Original-Message-ID: <CAGBSGjp1APwLDk4uy8o+qvk62ZCnOJ4w54xPd7QEX1s+ZMZzog@mail.gmail.com>
Message-ID: <CAGBSGjp1APwLDk4uy8o+qvk62ZCnOJ4w54xPd7QEX1s+ZMZzog@mail.gmail.com>
To: Dick Hardt <dick.hardt@gmail.com>
Cc: OAuth WG <oauth@ietf.org>, Denis <denis.ietf@free.fr>, Torsten Lodderstedt <torsten@lodderstedt.net>
Content-Type: multipart/alternative; boundary="0000000000006308ba05ac892ca9"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/b3Y6OTVaz0PasUQzO5DY99tV-pA>
Subject: Re: [OAUTH-WG] Privacy Considerations section in OAuth 2.1?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Aug 2020 17:20:43 -0000

I agree that there is nothing unique to PAR that would justify adding the
privacy considerations mentioned to that draft. I wouldn't oppose adding a
privacy considerations section to OAuth 2.1 though.

Aaron


On Mon, Aug 10, 2020 at 9:42 AM Dick Hardt <dick.hardt@gmail.com> wrote:

> In the PAR meeting today, Denis requested there be a privacy
> considerations section in PAR. I don't think there is anything specific in
> PAR that would change the privacy considerations of OAuth, and am checking
> if there is WG interest, and consensus, on including a Privacy
> Considerations section in the OAuth 2.1 draft.
>
> /Dick
> ᐧ
>