<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The rub is that from a security point of view encryption of the user-info endpoint needs to be part of the original request or registration.<div><br></div><div>If dynamic in the user-info api then an attacker wouldn't ask for the response to be encrypted.</div><div><br></div><div>Signing being controlled by the user-info api would be OK.</div><div><br></div><div>John B.<br><div><div>On 2011-07-23, at 8:23 AM, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF"><div>Yes. In the full spec, asking at the request time is an obvious solution. But the Lite does not have a way to do it apart from the out of band return_to registration time as it does not have claims syntax. <br>
<br>=nat via iPhone</div><div><br>On 2011/07/23, at 5:14, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>I don't know that it is practical to register purpose of use at registration.<div>
<br></div><div>I was thinking that that would eventually become part of the claim request meta-data, along with value and required trust framework etc.</div><div><br></div><div>It makes the request larger but is more flexible. </div>
<div><br></div><div>The other place to list that would be in some third party certified meta-data.</div><div><br></div><div>I could see checking with a meta-data repository if a RP is certified for EU safe harbour, and what attributes they are approved to collect.</div>
<div>That is sort of what Germany is doing now with there EID.</div><div><br></div><div>John<br><div><div>On 2011-07-23, at 4:02 AM, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi. <div>
<br></div><div>I have started to contemplate on the privacy considerations. </div><div><br></div><div>Several questions arises: </div><div><br></div><div>- When is the purpose of the use of the attribute determined? </div>
<div> -> either the claim request, or the redirect_url registration time. </div><div>- Is it not a good practice to return the terms of use of the data with it? </div><div>- Is it not releasing too much information as a default? </div>
<div>- Should not the access log to the UserInfo made accessible to the user? </div><div><br></div><div>Best, <br clear="all"><br>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank"></a><a href="http://nat.sakimura.org/">http://nat.sakimura.org/</a><br>
@_nat_en</div><br>
</div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net"></a><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></blockquote></div><br></div></div></blockquote></div>
</blockquote></div><br></div></body></html>