Re: [Unbearable] WGLC 3 on core documents

[Brian Campbell <[e-mail]>]

That works for me. Thanks.

On Thu, Mar 2, 2017 at 2:27 PM, Andrei Popov <[e-mail]>
wrote:

> Without “different servers”, it is not clear what these keys are supposed
> to be different from. J
>
>
>
> How about this:
>
> “In order to prevent cooperating servers from linking user identities, the
> scope of the Token Binding keys MUST NOT be broader than the scope of the
> tokens, as defined by the application protocol.”
>
>
>
> *From:* Brian Campbell [mailto:[e-mail]]
> *Sent:* Thursday, March 2, 2017 5:44 AM
> *To:* Martin Thomson <[e-mail]>
> *Cc:* Andrei Popov <[e-mail]>; Leif Johansson <
> [e-mail]>; [e-mail]
> *Subject:* Re: [Unbearable] WGLC 3 on core documents
>
>
>
>
>
>
>
> On Wed, Mar 1, 2017 at 4:43 PM, Martin Thomson <[e-mail]>
> wrote:
>
> On 2 March 2017 at 08:21, Brian Campbell <[e-mail]>
> wrote:
> >> I believe there was some opposition to MUST, for deployments where the
> >> client has knowledge of the cooperating servers. If nobody opposes a
> switch
> >> to MUST, I think it may be a good change to make.
> >
> >
> > Yes there's a desire for the allowance of different scoping rules for
> > application protocols where there's already knowledge of the cooperating
> > servers and/or correlatable info is already being sent in a token to
> > different servers.
>
> That's not an argument for SHOULD, that's an argument for flexibility
> in scoping rules, which you already have.  Since the application
> protocol determines the scoping rules, you can let the MUST stand and
> define scoping rules for the application protocol that suit your
> needs.
>
>
>
> Yes it's an argument for flexibility. My concern is with how the text
> might be interrupted. With the SHOULD to MUST change you're suggesting, it
> would say,
>
>  "In order to prevent cooperating
>    servers from linking user identities, different keys MUST be used
>    by the client for connections to different servers, according to the
>    token scoping rules of the application protocol."
>
> And I worry that some will zero in on the "different keys MUST be used by
> the client for connections to different servers" and take it very literally
> (especially the "to different servers" part) and out of context of the rest
> of the sentence that qualifies it with respect to the application protocol
> token scoping rules. Maybe that worry is unfounded but having it be SHOULD
> felt like it helps give that flexibility.
>
> I take your point though.
>
> What if it just said,
>
>
>  "In order to prevent cooperating
>    servers from linking user identities, different keys MUST be used
>    by the client, according to the
>    token scoping rules of the application protocol."
>
> taking the "different servers" bit out?
>
>
>