Re: [Txauth] Reviewing draft-hardt-xauth-protocol-11

[Tom Jones <[e-mail]>]

pii = personally identifiable information - it is from the GDPR - i am
not so fond of it myself but it has been used on this list before.
human on internet ==> there exists a user agent.  I never mentioned the
other direction.
RO seems to be used as a real world term.  subject is a digital identifier
which has been used and misused for decades.
i use the word "user" in a different meaning than you - i guess we should
remove the term if there is no common meaning. I detest arguing about the
meaning of words.

Peace ..tom


On Mon, Jul 20, 2020 at 11:54 AM Francis Pouatcha <[e-mail]> wrote:

> Hello Tom,
>
>
>> This interchange exhibits an essential problem of most of this work. The
>> idea that humans populate the web. I have yet to see a human with an
>> ethernet connection. So i must assume that the user agent is the essence of
>> the human on the web.
>>
> No. The User agent is the agent of the User. The RO agent is the agent of
> the RO. Off course the word "agent" only appears when the party (RO, User)
> assuming a role needs some means of interacting with other parties.
>
> Referring to a User agent does not conclude to the User being a human.
>
>>
>> Second there are two terms which need to be distinct in the general case
>> - at least where the RO is a human and the resource contains PII.
>>
> What is PII?
>
>> The RO aka subject is the identifier that is used by a real world human
>> that has data on the web that is (inter alia) PII about them.
>>
> Next confusion: RO vs. Subject.
>
>> The user aka guardian (and often also the subject) is the identifier that
>> is used by a real world human that has acquired control of access to the
>> PII about the subject.
>>
> Next confusion: User vs. Subject
>
> This last sentence looks like the content of a new thread....
>
>
> --
> Francis Pouatcha
> Co-Founder and Technical Lead
> adorsys GmbH & Co. KG
> https://adorsys-platform.de/solutions/
>