<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Dick,<div><br></div><div>Most universities can't send out students' grades or other sensitive information via email, as counsel and AACRAO judged it to be a potential FERPA violation, sooo...</div><div><br></div><div>That aside, it's still an interesting parallel, given that historically universities have always provided email services for every member of the organization. Students have always been largely free to forward their mail to whomever they want, or transcribe it on their local bathroom stall. That's been their choice.</div><div><br></div><div>Some schools are now outsourcing email entirely, though. In fact, they sometimes do so using Shibboleth to leverage campus identities for email as a service. Is removing that choice by only operating outsourced email fundamentally bad?</div><div><br></div><div>Well, there are the FERPA risks and occasional subpoenas. Public universities often comply with open records laws, which impose requirements on data retention. Some people are worried about these issues, and others think they're no problem. They haven't been tested in vitro yet. Here's a recent article:</div><div><br></div><div><a href="http://www.insidehighered.com/news/2008/03/21/privacy">http://www.insidehighered.com/news/2008/03/21/privacy</a></div><div><br></div><div><div>It's a tough choice for a lot of schools. However, email is -- or, at least, it should be -- fundamentally different from identity. Email is an application. Federated identity plumbs many applications with lots of different data about individuals.</div><div><br></div><div>The quality of that data matters for some applications, particularly the ones involving financial transactions. If, for example, someone sets up an open proxy in an IP-address based access control scheme, the university's often the one that gets fined/sued. Not fun, so we'd like to do better than that.</div></div><div><br></div><div>Check out university, bank, and corporate password reset policies, for the ones that don't require some form of token. You'll find them to differ from what your average email provider does.</div><div><br></div><div>Take care,</div><div>Nate.</div><div><br></div><div><div><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Curious how you determine the reputation of the email provider for your users.</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Email contains very sensitive, private information and likely falls under the same privacy laws and FERPA.</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">I don't see alot of difference between an OpenID Provider and an Email Provider.</font></p> </blockquote></div><br></div></body></html>