Re: [Rats] Call for charter consensus

[Benjamin Kaduk <[e-mail]>]

Hi Laurence,

On Thu, Jan 17, 2019 at 10:17:30PM -0800, Laurence Lundblade wrote:
> Hi Nancy,
> 
> The charter lists some types of claims/assertions in the introduction.  That list does not include things like GPS Location, public part of key pairs generated on device, enforced conditions for use of that key, identity of an app requesting a token, and app/user defined claims. Most of these types of claims have been implemented already either by FIDO, Android attestation or other products.  A vision here is that Android or other types of apps prove who they are to the server and pass a lot of data to the relying party via the token, often as input to authentication and financial transaction risk engines. 
> 
> 
> I assume it will continue to hold that anyone can add any proprietary claim they want, but a lot of the types of claims/assertions I just mentioned would be valuable as a standard. Some will be relatively easy to standardize. Some may not be. My first thought is that some of the easy obvious ones should be in scope, but we need to draw a line somewhere so we’re not creating claims forever. Not sure where that line is.

Those are good points.  I think it's probably premature to wire down a
specific list of claims at charter time, so the list in the introduction
should be treated as exemplary rather than normative, as is typical for
charter introductions.  Perhaps we want to add another bullet "other
factors that could influence trust decisions" to make that more clear.

-Ben