<html>
<head>
<meta name="generator" content="Windows Mail 17.4.9600.16384">
<style><!--
.EmailQuote {
margin-left:1pt;
padding-left:4pt;
border-left:#800000 2px solid;
}
--></style><style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic',sans-serif;font-size:12pt;"><div>Why the sensitivity, and why the record making? General lists are not formal (precisely so comment is freer).</div><div><br></div><div>First rule of PR… don't say anything (whiny) that you don't want to have followed up - by someone who asserts they are some kind of "citizen journalist” (without the professional code of accredited journalists). So don't follow *this* up. Yes, I know my saying that kind of thing is how national security agency folks abuse the social web (to dominate, influence, mis-characterize and otherwise "dominate” the public space). Shame on me!</div><div><br></div><div>But, it is interesting how the topic of openid (and associated identitfiers) and openid connect is opening up the SIM card, its key stores, its key management provisioning processes - recalling that its the largest deployment of (Crypto-capable, OTAR-ready ) smartcards on the planet. Rules, in GSM land, that prevented Euro-and-Scandinavian-Telco - for 25+ years! - from re-purposing the (really excellent) roaming and billing re-homing features of that federated-network design are changing (now the cat is out of the bag on why, spying related, folks were regulated from making side-businesses on the internet, as it took off). Now, in the US I even own my phone (!) and the data on it - vs lease it and “license [my own] data” from the Telco under some 2 year plan (under the change of rules that allows me to swap providers at will, now, providing I bring my own phone…). Legal accountability for the data now changes (with a click on the phone being a signature, NOW)</div><div><br></div><div>Of course, none of this “policy change” could have take effect without folks having determined that it would NOT have any material impact on surveillance capabilities built into telco, or the military FUNCTION of the open and social web to be (also) the VECTOR BY WHICH network trust boundaries are compromised (for more serious levels of spying…). Open ID in general has to be assumed to part of that policy world and its changes (being originally all about the social web). It will be fun, as the policy changes rollout and generate the next level of the OECD-designed-web, to see how openid members continue to evolve the association.<br></div><div data-signatureblock="true"><div><br></div><div>Sent from Surface Pro</div><div><br></div></div><div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid;"><div><font face="Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif" style='line-height: 15pt; letter-spacing: 0.02em; font-family: Calibri, "Segoe UI", Meiryo, "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "Khmer UI", "Nirmala UI", Tunga, "Lao UI", Ebrima, sans-serif; font-size: 12pt;'><b>From:</b> <a href="mailto:don@oidf.org" target="_parent">Don Thibeau</a><br><b>Sent:</b> Friday, March 21, 2014 5:41 AM<br><b>To:</b> <a href="mailto:openid-general@lists.openid.net" target="_parent">openid-general@lists.openid.net</a></font></div></div><div><br></div>
<div class="PlainText">For the record I do not recall the comment nor agree with the the interpretation Kaliya Hamlin attributes to me.<br>
<br>
Don Thibeau<br>
The OpenID Foundation<br>
<br>
<br>
<br>
On Mar 21, 2014, at 8:00 AM, openid-general-request@lists.openid.net wrote:<br>
<br>
Send general mailing list submissions to<br>
openid-general@lists.openid.net<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_parent">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
or, via email, send a message with subject or body 'help' to<br>
openid-general-request@lists.openid.net<br>
<br>
You can reach the person managing the list at<br>
openid-general-owner@lists.openid.net<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of general digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: [OpenID board] [Board-ec] Fwd: JTC1_N13405-Proposal for<br>
a liaison C between Open ID Foundation and ISO/IEC JTC1 SC27 WG5<br>
(Nat Sakimura)<br>
2. Growing list of OpenID Connect libraries available (Mike Jones)<br>
3. Re: Growing list of OpenID Connect libraries available<br>
(Peter Williams)<br>
4. Re: [OpenID board] [Board-ec] Fwd: JTC1_N13405-Proposal for<br>
a liaison C between Open ID Foundation and ISO/IEC JTC1 SC27 WG5<br>
(John Bradley)<br>
5. Re: [OpenID board] [Board-ec] Fwd: JTC1_N13405-Proposal for<br>
a liaison C between Open ID Foundation and ISO/IEC JTC1 SC27 WG5<br>
(Torsten Lodderstedt)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 21 Mar 2014 09:47:22 +0900<br>
From: Nat Sakimura <sakimura@gmail.com><br>
To: Kaliya Identity Woman <identitywoman@gmail.com><br>
Cc: "openid-general@lists.openid.net"<br>
<openid-general@lists.openid.net><br>
Subject: Re: [OpenID] [OpenID board] [Board-ec] Fwd:<br>
JTC1_N13405-Proposal for a liaison C between Open ID Foundation and<br>
ISO/IEC JTC1 SC27 WG5<br>
Message-ID:<br>
<CABzCy2DMNDdpokEiG9Bu9YXyAwXi4MXit4vb5JYd4Cixa9LKRA@mail.gmail.com><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Removing: board@openid.net and board-ec@openid.net from the Cc list and<br>
adding openid-general since this is more of a community question and not<br>
the board discussion.<br>
<br>
2014-03-21 7:31 GMT+09:00 Kaliya Identity Woman <identitywoman@gmail.com>:<br>
<br>
> I asked Don last time we were in person if the GSMA in its use/adoption of<br>
> OpenID was going to enable people to easily have more then one profile on<br>
> their device. He basically said they hadn't thought of it and in effect<br>
> said "nope".<br>
<br>
<br>
Actually, this is not true. Many telcos are perfectly willing to give<br>
ability to the consumers multiple "identities".<br>
The credential being SIM based and the support of multiple<br>
"identity/partial identity/paersona" is an orthogonal thing.<br>
Perhaps Torsten can chime in here as well.<br>
<br>
-- <br>
Nat Sakimura (=nat)<br>
Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_parent">http://nat.sakimura.org/</a><br>
@_nat_en<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openid.net/pipermail/openid-general/attachments/20140321/7546fd9c/attachment-0001.html" target="_parent">http://lists.openid.net/pipermail/openid-general/attachments/20140321/7546fd9c/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Fri, 21 Mar 2014 00:55:03 +0000<br>
From: Mike Jones <Michael.Jones@microsoft.com><br>
To: "code@openid.net" <code@openid.net>, "general@openid.net"<br>
<general@openid.net><br>
Subject: [OpenID] Growing list of OpenID Connect libraries available<br>
Message-ID:<br>
<4E1F6AAD24975D4BA5B16804296739439A101D60@TK5EX14MBXC286.redmond.corp.microsoft.com><br>
<br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
The list of publicly available OpenID Connect libraries is growing, with implementations available for numerous development platforms and environments, including Drupal, Java, PHP, Python, and Ruby. See the Libraries<<a href="http://openid.net/developers/libraries/" target="_parent">http://openid.net/developers/libraries/</a>> page for a list of OpenID Connect<<a href="http://openid.net/connect/" target="_parent">http://openid.net/connect/</a>> libraries, as well as libraries implementing the related JSON Web Token (JWT) and JSON Object Signing and Encryption (JOSE) specifications. These libraries make it easy to join the likewise growing list of OpenID Connect deployments.<br>
<br>
If your library isn't listed and you'd like it to be, please drop us a note on the code@openid.net mailing list<<a href="http://lists.openid.net/mailman/listinfo/openid-code" target="_parent">http://lists.openid.net/mailman/listinfo/openid-code</a>> or the general@openid.net mailing list<<a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_parent">http://lists.openid.net/mailman/listinfo/openid-general</a>>.<br>
<br>
Also, if you're interested in participating in OpenID Connect interop testing, please join the openid-connect-interop@googlegroups.com mailing list<<a href="http://groups.google.com/group/openid-connect-interop" target="_parent">http://groups.google.com/group/openid-connect-interop</a>> and ask to be added to the current OpenID Connect interop<<a href="http://osis.idcommons.net/wiki/OC5:OpenID_Connect_Interop_5" target="_parent">http://osis.idcommons.net/wiki/OC5:OpenID_Connect_Interop_5</a>>.<br>
<br>
-- Mike<br>
<br>
P.S. This note was also posted at <a href="http://openid.net/2014/03/20/growing-list-of-openid-connect-libraries-available/" target="_parent">http://openid.net/2014/03/20/growing-list-of-openid-connect-libraries-available/</a> and tweeted as @openid.<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openid.net/pipermail/openid-general/attachments/20140321/40e3a12e/attachment-0001.html" target="_parent">http://lists.openid.net/pipermail/openid-general/attachments/20140321/40e3a12e/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Fri, 21 Mar 2014 01:00:15 +0000<br>
From: Peter Williams <home_pw@msn.com><br>
To: "=?utf-8?Q?general@openid.net?=" <general@openid.net><br>
Subject: Re: [OpenID] Growing list of OpenID Connect libraries<br>
available<br>
Message-ID: <SNT405-EAS299C9306F05BCC3C806F9992790@phx.gbl><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I'll give a small challenge and feedback for developers - addressing a challenge I see. The challenge is due to the ?ever changing? websso world.<br>
<br>
<br>
We have a joomla deployment, that REALLY exploits websso. From claims in the inbound assertion, all sorts of application roles drive menus, drive profiles, drive link visibility, drive page embedding, (etc etc). I think this was known, in the last round of fancy marketing, as claims driven apps (or something). Identity metasystem, or something. Hey, it may even have been ?user centric?.<br>
<br>
<br>
I'd love to move FROM current ws-fedp plugin (that cost a $1000 to do, when given to the right person) to openid connect. Perhaps, I could find another $1000?<br>
<br>
<br>
Now, I'm not known as the smartest key on the chain, and still see the world in simple terms. I'm happy for such as the Microsoft openid connect solution (in the cloud) to invoke websso for me (in response to an openid connect request - for an id_token). Sure, I could make Joomla call openid connect (to invoke websso). And, obviously, a token translation occurs on the return leg, moving values from the ws-fedp-delivered assertion (from the websso step) to the oauth authorization process (that delivers a nice JWT to me, with some of the ?claims? from the websso step).<br>
<br>
<br>
If I cannot get the claims I currently get (from direct access to websso), I cannot move to openid connect (which gives me ONLY indirect access to websso, and claims handover that is decided by others). Which makes openid connect MIGRATION hard ).<br>
<br>
<br>
Yes - you might way - your silly implementation, Peter, doesn't fit the "Intended pattern?. Which is, of course, your fault (for buying into last years marketing, around claims, if not user centric consent and control). Rebuild it all (and adopt the ?right pattern?!!). And, of course that will happen (when one just dumps - rather than revises - the ?old? stuff) <br>
<br>
<br>
Of course, that is not reality (as code and patterns marketed and adopted only 2 years ago have a multiple year lifetime, down here on main street. Not all of us are billion dollar companies (with payoffs from natsec agencies or potential federal cloud contracts for 100,000 tenants?).<br>
<br>
<br>
<br>
Just some feedback on ?adoption?, in that 80% of the market that is ?bound up? in legacy cost economics. Even legacy of ? 2 years ago.<br>
<br>
<br>
Having ?groked? openid connect (thanks to superb Microsoft cloud-based delivery of it ), I'm for it (now I get it). Now reality sets in. Change is hampered by the ?advanced? stuff done , ahem, 2 years ago - whose very PATTERN is already considered ?legacy?. <br>
<br>
<br>
Hopefully this spurs the next generation of developers - who know a bit that large market of <br>
?legacy migration? (from claims to connect?)<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
From: Mike Jones<br>
Sent: ?Thursday?, ?March? ?20?, ?2014 ?5?:?55? ?PM<br>
To: code@openid.net, general@openid.net<br>
<br>
<br>
<br>
<br>
<br>
<br>
The list of publicly available OpenID Connect libraries is growing, with implementations available for numerous development platforms and environments, including Drupal, Java, PHP, Python, and Ruby. See the Libraries page for a list of OpenID Connect libraries, as well as libraries implementing the related JSON Web Token (JWT) and JSON Object Signing and Encryption (JOSE) specifications. These libraries make it easy to join the likewise growing list of OpenID Connect deployments.<br>
<br>
If your library isn?t listed and you?d like it to be, please drop us a note on the code@openid.net mailing list or the general@openid.net mailing list.<br>
<br>
Also, if you?re interested in participating in OpenID Connect interop testing, please join the openid-connect-interop@googlegroups.com mailing list and ask to be added to the current OpenID Connect interop.<br>
<br>
<br>
<br>
-- Mike<br>
<br>
<br>
<br>
P.S. This note was also posted at <a href="http://openid.net/2014/03/20/growing-list-of-openid-connect-libraries-available/" target="_parent">http://openid.net/2014/03/20/growing-list-of-openid-connect-libraries-available/</a> and tweeted as @openid.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openid.net/pipermail/openid-general/attachments/20140321/25559c72/attachment-0001.html" target="_parent">http://lists.openid.net/pipermail/openid-general/attachments/20140321/25559c72/attachment-0001.html</a>><br>
-------------- next part --------------<br>
_______________________________________________<br>
general mailing list<br>
general@lists.openid.net<br>
<a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_parent">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Fri, 21 Mar 2014 00:46:24 -0300<br>
From: John Bradley <ve7jtb@ve7jtb.com><br>
To: Nat Sakimura <sakimura@gmail.com><br>
Cc: "openid-general@lists.openid.net"<br>
<openid-general@lists.openid.net><br>
Subject: Re: [OpenID] [OpenID board] [Board-ec] Fwd:<br>
JTC1_N13405-Proposal for a liaison C between Open ID Foundation and<br>
ISO/IEC JTC1 SC27 WG5<br>
Message-ID: <FE2669E9-B157-497A-8C92-EE9EEB709A6C@ve7jtb.com><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
In discussions I have had with Mobile operators privacy has been a concern, though that may be influenced by many of them being in Europe and having to conform to much stricter privacy laws than in the US.<br>
<br>
The connect profile is intended to create a common set of features and possibly a single registration point to make it possible for RP to deal with potentially 800 IdP given that the internet is global.<br>
<br>
I think many people will agree that creating a common identity layer rather than regional ones is a good thing.<br>
<br>
Asking about persona on the device may have confused the issue. It would surprise me if multiple persona including non corralatable ones are not supported for asserting to RP.<br>
<br>
That is different from multiple persona on the device being used for authentication to the MNO as the IdP. <br>
<br>
In developing the profile support for pairwise identifiers will need to be sorted out. They have privacy benefits as long as you are not handing out other corralatable attributes.<br>
<br>
One value add the MNO have is that they can provide proofed attributes with the users consent. In the multiple persona case there may be legal restrictions on them providing attributes they know are not true. So outside of the technical profile that we are developing there may be policy issues that the operators need to deal with.<br>
<br>
One side benefit of this is if the we get RP into the ecosystem this way and can move them to a world where they have to allow selection between hundreds of IdP then the NASCAR breaks down and there is more opportunity for specialist IdP like UnitedID to be accepted.<br>
<br>
John B.<br>
<br>
<br>
<br>
On Mar 20, 2014, at 9:47 PM, Nat Sakimura <sakimura@gmail.com> wrote:<br>
<br>
> Removing: board@openid.net and board-ec@openid.net from the Cc list and adding openid-general since this is more of a community question and not the board discussion. <br>
> <br>
> 2014-03-21 7:31 GMT+09:00 Kaliya Identity Woman <identitywoman@gmail.com>:<br>
> I asked Don last time we were in person if the GSMA in its use/adoption of OpenID was going to enable people to easily have more then one profile on their device. He basically said they hadn't thought of it and in effect said "nope". <br>
> <br>
> Actually, this is not true. Many telcos are perfectly willing to give ability to the consumers multiple "identities". <br>
> The credential being SIM based and the support of multiple "identity/partial identity/paersona" is an orthogonal thing. <br>
> Perhaps Torsten can chime in here as well. <br>
> <br>
> -- <br>
> Nat Sakimura (=nat)<br>
> Chairman, OpenID Foundation<br>
> <a href="http://nat.sakimura.org/" target="_parent">http://nat.sakimura.org/</a><br>
> @_nat_en<br>
> _______________________________________________<br>
> general mailing list<br>
> general@lists.openid.net<br>
> <a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_parent">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openid.net/pipermail/openid-general/attachments/20140321/f3ff1f02/attachment-0001.html" target="_parent">http://lists.openid.net/pipermail/openid-general/attachments/20140321/f3ff1f02/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Fri, 21 Mar 2014 07:36:36 +0100<br>
From: Torsten Lodderstedt <torsten@lodderstedt.net><br>
To: Nat Sakimura <sakimura@gmail.com>, Kaliya Identity Woman<br>
<identitywoman@gmail.com><br>
Cc: "openid-general@lists.openid.net"<br>
<openid-general@lists.openid.net><br>
Subject: Re: [OpenID] [OpenID board] [Board-ec] Fwd:<br>
JTC1_N13405-Proposal for a liaison C between Open ID Foundation and<br>
ISO/IEC JTC1 SC27 WG5<br>
Message-ID: <9m200p3klmqd6pem2uj9vtog.1395383796676@email.android.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Different operators have different capabilities and identify management philosophies. Due to our philosophy, which is rather decoupled from mobile subscriptions, Deutsche Telekom could offer an option to have multiple identities (where at most one of them is authenticated with the SIM card). It would require users to select their id per RP, which might be considered a UX issue.<br>
<br>
Regards,?<br>
Torsten.<br>
<br>
-------- Urspr?ngliche Nachricht --------<br>
Von: Nat Sakimura <sakimura@gmail.com> <br>
Datum:21.03.2014 01:47 (GMT+01:00) <br>
An: Kaliya Identity Woman <identitywoman@gmail.com> <br>
Cc: openid-general@lists.openid.net <br>
Betreff: Re: [OpenID] [OpenID board] [Board-ec] Fwd: JTC1_N13405-Proposal for a liaison C between Open ID Foundation and ISO/IEC JTC1 SC27 WG5 <br>
<br>
Removing: board@openid.net and board-ec@openid.net from the Cc list and adding openid-general since this is more of a community question and not the board discussion.?<br>
<br>
2014-03-21 7:31 GMT+09:00 Kaliya Identity Woman <identitywoman@gmail.com>:<br>
I asked Don last time we were in person if the GSMA in its use/adoption of OpenID was going to enable people to easily have more then one profile on their device. He basically said they hadn't thought of it and in effect said "nope".?<br>
<br>
Actually, this is not true. Many telcos are perfectly willing to give ability to the consumers multiple "identities".?<br>
The credential being SIM based and the support of multiple "identity/partial identity/paersona" is an orthogonal thing.?<br>
Perhaps Torsten can chime in here as well.?<br>
<br>
-- <br>
Nat Sakimura (=nat)<br>
Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_parent">http://nat.sakimura.org/</a><br>
@_nat_en<br>
-</div></div>
</body>
</html>