Re: [VoT] Foundational questions of principle

["Cantor, Scott" <[e-mail]>]

On 10/9/14, 7:16 PM, "[e-mail]" <[e-mail]>
wrote:

>
> 
>I like your approach.  But I think we should review what the objective is
>of LOAs in general, and question whether or not labeling things by
>"level" is a useful idea. Yes we need to help organisations better
>understand and manage authentication risk, but is "LOA" is a necessary
>output of that process?  Doesn't a four level label over simplify things?
>I find it's a misleading shorthand that leads people to believe that a
>given identity can be used at a given RP without any further analysis.

I think that taking complex ideas and reducing them to levels is overly
simplifying, and it would be better to just define a schema for attribute
data to express in each area.

But my personal *experience* is that applications won't do the work of
building and enforcing polices around that fine-grained a way of
expressing the information. They don't do it well with user attributes, so
there's even less chance they'd do it with data that isn't even core to
their purpose.

Reducing to levels is a way of splitting the work and pushing more of it
to other parties that care enough to do the work.

Perhaps some of the "vectors" are more amenable to reduction to levels
than others. I tend to agree with others' comments that things like
incident response and the operational maturity issues probably don't
reduce well to levels. So maybe both approaches are needed if there are
concrete justifications for them.

And to be honest, I have a lot more concrete evidence that those
non-linear concepts are of interest to applications than I do most of the
traditional assurance-related vectors. And I think they're *more*
well-defined, not less. Most of the easily linear concepts seem like
solutions looking for a problem to me, with the exception of
authentication quality.

-- Scott