Re: [regext] Privacy and HR considerations for draft-ietf-regext-verificationcode
"Gould, James" <jgould@verisign.com> Wed, 19 December 2018 19:31 UTC
Return-Path: <jgould@verisign.com>
X-Original-To: regext@ietfa.amsl.com
Delivered-To: regext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 939F6130ECF for <regext@ietfa.amsl.com>; Wed, 19 Dec 2018 11:31:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XyXeN354fEXA for <regext@ietfa.amsl.com>; Wed, 19 Dec 2018 11:31:15 -0800 (PST)
Received: from mail4.verisign.com (mail4.verisign.com [69.58.187.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A916F130EC6 for <regext@ietf.org>; Wed, 19 Dec 2018 11:31:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=4134; q=dns/txt; s=VRSN; t=1545247874; h=from:to:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:subject; bh=+1fXh1j6ktVkFHuNbYbjnUYOSEzkn4iHqUcuJihkKO0=; b=MgB4h4ZIfs6J6Oq+GNjUJHwYb9Po6y6Boep7OniMe23qofUkeiCMcWLQ LZfbL7+Yic4bvpUHh2ZgNAiLEAP8vAMRRrhW2Ff5Mjd+ZsNyYvzDfVTie 0I3hKfXRNgA4KFRjXNWboQK+qAx840yUWSBkotVAl/S62R5KB740I5eKy UNSWVvmver+813gZ+mpsHKatAcfAZkiuLQKsDuYn9HvZJdVxSo9HkpykH NcWUvCK/omnjRhg2GoxGt2HG+wbMbU0v7uOsr61wNRUb350YsIFVxavlw 2dTFixo9paaYBrVCOgJakLx7PSTDA2cSp4TutE71W+NzfNy+4hE2QnvHx w==;
X-IronPort-AV: E=Sophos;i="5.56,373,1539662400"; d="scan'208";a="6622680"
IronPort-PHdr: 9a23:9Si3Ah0kHIqm5DS2smDT+DRfVm0co7zxezQtwd8ZsesWL/zxwZ3uMQTl6Ol3ixeRBMOHs6IC07KempujcFRI2YyGvnEGfc4EfD4+ouJSoTYdBtWYA1bwNv/gYn9yNs1DUFh44yPzahANS47xaFLIv3K98yMZFAnhOgppPOT1HZPZg9iq2+yo9JDffwZFiCChbb9uMR67sRjfus4KjIV4N60/0AHJonxGe+RXwWNnO1eelAvi68mz4ZBu7T1et+ou+MBcX6r6eb84TaFDAzQ9L281/szrugLdQgaJ+3ART38ZkhtMAwjC8RH6QpL8uTb0u+ZhxCWXO9D9QLYpUjqg8qhrUgflhicZOTAk7GHZhM9+jKxZrx2vphxw34Hab46OOfpiZazdeM8WSXZbU8tTUSFKH4Oyb5EID+oEJetUoYjzp1wTrRu6GAagHP7kxDtSiX/zw6I6yOotGhzB0QwiENIOt2nUrNHoO6oJT+C60rPIzTTYb/NX1jf97pLEfQwmofGJRL99d9fax0coFwPAlFqQqIrlMiuL1usTqWib7vFgVeOgi24hqgFxpCSgyt0whYnOg4IYzE3P+yZhwIstONG0VFR3bcOmHZZerS2WKot7T804T2xnuys20qAKtYKhcCQXypkr2wTTZ+GIfoWL+B7vSeWcLS92hH17e7+zmxO//E26xeD/UsS7y1NHoyRbntbRt30A0gfc58yGR/Z/+0qs1ziC2gLO5exCPEs6j7DUK4Q7zb41jpcTtEPDETLol0jul6+Wc1kk+vCv6+T6frXqvp+cOJFwigH5Kqkjh9CxD/wlPgcOR2aV9uWz2KH+8UHjXrVFkvo2krPBsJzAP8sUu7S1AxFP0oY47RazFSup0NMdnXUfLVJFfgyIj5TxNl3TPPz0F+qzjlainTtx2vzLPrPsDo/CI3XAiLvheKxy609YyAo919Bf4JdUB6kDIPL8XU/xqdjYAQIiPgyq3ennEtR91pgfWWKABK+VKr/dsViN5u43OemDeJcVuCrhK/gi//PugmI5mUUGfampx5QYc2q3Eel9LkqFYHrsmc4NEWYMvgUjTezlkkeOUTlJZ3a9R6g8/C00CJq6DYffQYCgmKaO3CGmEZxWfW1GCl+NEW3ye4WZQPcGcDiSLdN5kjwYSbihTJcs1Quwuw/11bVmIfbU9zYZtZ39yNh16ffflRYo9Tx7XIyh1DTHQHxuhWMBTTY69Kt+ugl8zFuC2O5/mfMSXYhc+ulSUg4wPJL0xO1hTtH0VgPIONCTRwDiCp+vBz0gZtIh2ZkTeAw1T9ykggHr3zqwRaIOwfjDToY5/a/Mw1DwKtpzjXHc2+Np20MrTcZfKUWni7JxsQ/JCNiavV+ekvPgWqMB2CKJvEWKyGeV9gkMUgF3TKHJdW4SfErNrNv/oEjFSun9WvwcLgJdxJvaeeNxYdrzgAAeSQ==
X-IPAS-Result: A2EeAAA2nBpc/zCZrQphAx0BAQUBBwUBgVEIAQsBgVqBD4EpCoNziBmNZCWSYIR+gT88DAEfD4Q+AheCdzQJDQEDAQEBAQEBAgEBAoEFDII2IhJNLwkBMgEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQgCCAdHAQEZAQUjEVUCAQgYAgImAgICMBUQAgQBEoJwMgGqGYEvijKBC4tLgUE+gREnDBOCTIRrFgwLCiaCQTGCJgKJSZdrAwYChw6BC4lfgV5Njy6JSIR5ixoCBAIEBQIUgUaCD3AVZQGCQQmCR20BB4JDilNyDSSNF4EfAQE
Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1531.3; Wed, 19 Dec 2018 14:31:12 -0500
Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%5]) with mapi id 15.01.1531.003; Wed, 19 Dec 2018 14:31:12 -0500
From: "Gould, James" <jgould@verisign.com>
To: "gurshabad@cis-india.org" <gurshabad@cis-india.org>, "andy@hxr.us" <andy@hxr.us>, "regext@ietf.org" <regext@ietf.org>
Thread-Topic: [EXTERNAL] Re: [regext] Privacy and HR considerations for draft-ietf-regext-verificationcode
Thread-Index: AQHUlxVqlYBPqhgCwUiJL3hXFpv+MKWGLv8AgABFogA=
Date: Wed, 19 Dec 2018 19:31:12 +0000
Message-ID: <CD20307A-3E10-414E-8463-E2233F3F9E99@verisign.com>
References: <5f7d0b3e-c844-1700-c369-90bb41e8241e@cis-india.org> <CAAQiQReVnuwFBCA2vOwnwaUw8k+1TCK-5DO+KLsd=CWF3Lh8Cg@mail.gmail.com> <90404577-8405-c48f-351b-2c157a24de6d@cis-india.org>
In-Reply-To: <90404577-8405-c48f-351b-2c157a24de6d@cis-india.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.10.3.181015
x-originating-ip: [10.170.148.18]
Content-Type: text/plain; charset="utf-8"
Content-ID: <22A1640AA8673D42AD632F4C8DD660A1@verisign.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/regext/WfC43m281PGzMR27Wbj2nuHQnJ8>
Subject: Re: [regext] Privacy and HR considerations for draft-ietf-regext-verificationcode
X-BeenThere: regext@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Registration Protocols Extensions <regext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/regext>, <mailto:regext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/regext/>
List-Post: <mailto:regext@ietf.org>
List-Help: <mailto:regext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/regext>, <mailto:regext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Dec 2018 19:31:18 -0000
Gurshabad, Your proposed Privacy Considerations section and much of your proposed Human Rights Considerations section focuses on the interface of the VSP, which is out-of-scope for draft-ietf-regext-verificationcode. The scope of draft-ietf-regext-verificationcode is on the structure of the digitally signed verification code, that represents proof of verification, and the interface between the client (registrar) and the server (registry) to pass the verification code. The role of the VSP is defined, but the VSP interface and the concrete verifications is by design left out of draft-ietf-regext-verificationcode, and therefore is out-of-scope. Niels support for inclusion based on “causation, and more specifically the priority events” is beyond the scope of draft-ietf-regext-verificationcode and is not applicable. We need to ensure to keep the technical and considerations text strictly focused on the defined scope of the draft. — JG James Gould Distinguished Engineer jgould@Verisign.com 703-948-3271 12061 Bluemont Way Reston, VA 20190 Verisign.com <http://verisigninc.com/> On 12/19/18, 5:22 AM, "regext on behalf of Gurshabad Grover" <regext-bounces@ietf.org on behalf of gurshabad@cis-india.org> wrote: On 19/12/18 2:34 AM, Andrew Newton wrote: > > I thought the token was passed by the EPP client (registrar) to the > EPP server (registry), the purpose of which is to show that the > verification occurred before the transaction. > Thanks for pointing that out. A better way to phrase my concern would have been that the extension's functioning is dependent on data being shared with the VSP. The draft does describe some (not all of the necessary) aspects of that data sharing. Agree that the text could have been more accurate in reflecting that. Changes are incorporated below (will review the HRC section again in this light as well); for now, hope this reads better: Privacy Considerations ---------------------- The working of the described extension depends on the sharing of data of (or generated by) registrants with the Verification Service Provider (VSP), which is a third party. The specification leaves the scope of information shared with and stored by the VSP up to the policies of the locality. There may be no mechanisms for registrants to express preference for what information should shared with the VSP, in which case, registrants' sensitive personal information directly linked to the identities of the individual, such as contained in the contact mapping object, may be exposed to the VSP without user control. This personal information may be further correlated with other data sources available to the VSP. If a client seeks to implement or offer this extension, it MUST inform the registrant about about the exact information to be shared with the VSP.
- [regext] Privacy and HR considerations for draft-… Gurshabad Grover
- Re: [regext] Privacy and HR considerations for dr… John Levine
- Re: [regext] Privacy and HR considerations for dr… Adam Roach
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Gurshabad Grover
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Andrew Newton
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Adam Roach
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… Gurshabad Grover
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… John Levine
- Re: [regext] Privacy and HR considerations for dr… Gurshabad Grover
- Re: [regext] Privacy and HR considerations for dr… John Levine
- Re: [regext] Privacy and HR considerations for dr… Thomas Corte
- Re: [regext] Privacy and HR considerations for dr… Niels ten Oever
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… John R Levine
- Re: [regext] Privacy and HR considerations for dr… Adam Roach
- Re: [regext] Privacy and HR considerations for dr… John R Levine
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… John R Levine
- Re: [regext] Privacy and HR considerations for dr… Gould, James
- Re: [regext] Privacy and HR considerations for dr… Gurshabad Grover