Re: [Txauth] Support of FIDO and data minimization by RSs

[David Waite <[e-mail]>]

> On Jul 8, 2020, at 01:14, Denis <[e-mail]> wrote:
> 
> Hi Dick,
> 
>> Denis: you seem to keep implying that other architectures don't preserve privacy. A couple counterpoints:
>> 
>> Token opacity helps privacy in another dimension -- the client does not see the information about the user.
> The client is not an adversary to the user.
> 
Both users and authorization servers may have a limited amount of trust in clients, which is a reason we have scopes to limit authorization and why we have consent to limit exposure of user data in the form of claims within the OpenID Connect extension.

The access token is a message about the client from the authorization server to the protected resource, about the authorization. This might include internal details which a client should not know, including internal information in the case where the authorization and protected resource are part of the same domain.

>> Many OAuth developments have self contained tokens. There is no token introspection call. 
>> This, coupled with opaque tokens, is more privacy preserving than the client being able to peek in a token.
> When an access token contains personal information about a user, that user has the right to see that personal information.
> 
However that does not mean that data has to be exposed to all third party clients without user consent. The sensitive data may also not be personal data in which case the user does not have a right to see it, even under request. Finally, tokens may be issued to entities without equivalent rights, such as hardware devices.


-DW