<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
</head>
<body>
<div><!-- This file has been automatically generated. See web/README.md -->
<div>
<div>
<div style="direction: ltr;">I actually replied this to the OAuth mailing list. It may be a good idea to follow that thread.
</div>
<div><br>
</div>
<div style="direction: ltr;">For the mobile client, we were thinking of using Token Binding instead for sure, due to the correlation issues. But as far as the financial transactions are concerned, correlation is not a big privacy issue because we have KYC requirement
to start with. Then, the problem precipitates to the information disclosure through unencrypted channel, but as Neil mentioned in the above thread, the standard practice is to present the certificate in the re-negotiation only, which is encrypted.
</div>
<div><br>
</div>
<div style="direction: ltr;">Best, </div>
<div><br>
</div>
<div style="direction: ltr;">Nat Sakimura</div>
</div>
<div><br>
</div>
<div class="ms-outlook-ios-signature">
<div style="direction: ltr;">Nat Sakimura / n-sakimura@nri.co.jp / +81-90-6013-6276</div>
<div><br>
</div>
<div style="direction: ltr;">$B$3$N%a!<%k$K$O!"K\Mh$N08@h$NJ}$N$_$K8BDj$5$l$?5!L)>pJs$,4^$^$l$F$$$k>l9g$,$4$6$$$^$9!#$*?4$"$?$j$N$J$$>l9g$O!"@?$K?=$7Lu$4$6$$$^$;$s$,!"Aw?.<T$^$G$*CN$i$;D:$-!"$^$?<u?.$5$l$?%a!<%k$O:o=|$7$F$/$@$5$$$^$9$h$&$*4j$$?=$7>e$2$^$9!#(B</div>
<div><br>
</div>
<div style="direction: ltr;">PLEASE READ :This e-mail is confidential and intended for the named recipient only.</div>
<div style="direction: ltr;">If you are not an intended recipient, please notify the sender and delete this e-mail.
</div>
</div>
</div>
<div> </div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="dir="ltr""><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>$B:9=P?M(B:</b> Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> (Joseph Heenan via Openid-specs-fapi <openid-specs-fapi@lists.openid.net>
$B$NBeM}(B)<br>
<b>$BAw?.F|;~(B:</b> $BLZMKF|(B, 11$B7n(B 1, 2018 6:40 $B8a8e(B<br>
<b>$B08@h(B:</b> openid-specs-fapi@lists.openid.net<br>
<b>Cc:</b> Joseph Heenan<br>
<b>$B7oL>(B:</b> [Openid-specs-fapi] Issue #184: Privacy implications of oauth-mtls due to tls 1.2 sending client certs unencrypted (openid/fapi)
<div> </div>
</font></div>
New issue 184: Privacy implications of oauth-mtls due to tls 1.2 sending client certs unencrypted
<br>
https://bitbucket.org/openid/fapi/issues/184/privacy-implications-of-oauth-mtls-due-to
<br>
<br>
Joseph Heenan: <br>
<br>
This blog post has appeared recently: <br>
<br>
https://blog.funkthat.com/2018/10/tls-client-authentication-leaks-user.html <br>
<br>
Assuming it is correct this seems to have implications for privacy when following the FAPI specs, particularly part 2. Probably mainly in the case where a mobile device is doing dynamic client registration. We should probably mention this privacy consideration.
<br>
<br>
<br>
_______________________________________________ <br>
Openid-specs-fapi mailing list <br>
Openid-specs-fapi@lists.openid.net <br>
http://lists.openid.net/mailman/listinfo/openid-specs-fapi <br>
</div>
</body>
</html>