Re: [VoT] Vectors of Trust I-D feedback

Sorry, I have been experiencing network problems that the signal went up /
down many times.
Apparently, the web mail was reloading each time that happened and somehow
sending out the message each time.

I sincerely apologize it.

Nat

2015-08-04 15:44 GMT+09:00 sakimura <sakimura@gmail.com>:

> 2015-08-04 15:12 に Rainer Hoerbe さんは書きました:
>
>> Am 04.08.2015 um 00:31 schrieb Jim Fenton <fenton@bluepopcorn.net>:
>>
>>>
>>> To be entirely consistent with ISO/IEC 29115, we would need to rename
>>> Identity Proofing as Enrolment, and Credential Usage as Authentication.
>>>
>>
> Actually, renaming it as Enrollment may have some merit. Identity Proofing
> is only a process within Enrollment.
> There are whole bunch of other stuff that has to happen then.
> Even if the Identity Proofing was done perfectly, if the act of creating
> the record to the identity register is broken, it is broken.
>
>
>>> But ISO/IEC 29115 refers to these as phases: they occur at different
>>> times (or, in the case of Credential Management, over a long period of
>>> time) and have different threat models. But I would like to ask under which
>>> circumstances a Relying Party would act differently to an indication of
>>> less secure Credential Management vs. less secure Authentication.
>>>
>> For a targeted attack the weak credential recovery will lower the
>> adversary’s effort significantly, whereas in large numbers a 2F AuthN
>> combined will still reduce the overall risk.
>>
>
> +1. That is one of the reason I feel it is worthwhile to differentiate
> them.
>
>
>> There are credential management practices that would make a credential
>>> unsuitable for highly secure authentication, but why not just represent
>>> that as less secure authentication? VoT should be only as complex as
>>> required; it should not represent aspects of the process that the relying
>>> party does not need.
>>>
>>
>> +1. However, I remember a discussion at IIW where someone argued that
>> an important use case for VoT is the combination of C4 (U2F) with  P1
>> (self-asserted) for social ids. But social networks are prioritizing
>> usability over security with a weak recovery mechanism.
>>
>
> In private sector, there are lots of cases where identity proofing in the
> traditional sense does not
> matter but the secure authentication matters. I actually co-authored a
> paper on it last month.
>
>
>> - Rainer
>>
>> _______________________________________________
>> vot mailing list
>> vot@ietf.org
>> https://www.ietf.org/mailman/listinfo/vot
>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en