<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Pairwise pseudonymous allows the RP to recognize if the same user comes back, however it doesn't tell them who the user is in any way that they can correlate with other sites.<div><br></div><div>That seems to satisfy 90% of the privacy use cases.</div><div><br></div><div>The next step up would be to not allow them to recognize the same user between sessions. The IdP would use some session counter as part of the identifier calculation to generate a new one with each new login.</div><div>You however want it to be stable enough to be useful for session management, (detecting if the user in the browser has changed and the claims are no longer valid.</div><div><br></div><div>It sort of depends on what you are trying to protect against.</div><div><br></div><div>John B.</div><div><br></div><div><div><div>On 2012-12-01, at 4:23 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net">torsten@lodderstedt.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Do you mean there is effectively no difference between PPID and no user id since the RP can anyway recognize the user?<br>
<br>
regards,<br>
Torsten.<br><br><div class="gmail_quote"><br>
<br>
John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>> schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px">That could easily be done in the current spec.<br><br>I don't quite know why PPID won't work for you though.<br><br><br>On 2012-12-01, at 2:35 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net">torsten@lodderstedt.net</a>> wrote:<br><br><br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">What sort of tracking are you trying to stop?<br><br>If it is give me an attribute for the current person without<br>establishing a session that would be an ephemeral single use<br>identifier. (No session management)</blockquote><br>That's what I want. Would this require a new user id type?<br><br>Setting this per client id is fine.<br><br>Regards,<br>Torsten.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">If you want to have a session with the person based on claims but not<br>establish a persistent account then it would be per session ephemeral. <br>(session management/ change user is possible)<br><br>user_id_type in registration allows the identifier type to be set per<br>client.<br><br>We talked about having it in the request object, but allowing a client<br>to change it per request was seen as overkill.<br>Most IdP will restrict what a client can ask for based on some privacy<br>policy, so the discovery/registration mechanism was thought to be<br>sufficient.<br><br>Nothing stops a site from having multiple client ID if it needs to get<br>different identifier types. Having the different client ID stops a<br>client from asking for PPID and getting connect and then asking for a<br>public identifier in a later call where the user is not
notified.<br><br>John B.<br>On 2012-11-30, at 1:19 PM, Torsten Lodderstedt<br><<a href="mailto:torsten@lodderstedt.net">torsten@lodderstedt.net</a>> wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;">We don't want the RP to track the user. So we would need to issue<br></blockquote>different user_id for every request. But I don't think is fit into the<br>Connect philosophy.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;">regards,<br>Torsten.<br><br>Am 30.11.2012 17:11, schrieb Justin Richer:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;">Would using pairwise identifiers make this work?<br><br>-- Justin<br><br>On 11/30/2012 11:09 AM, Torsten Lodderstedt wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid
#e9b96e; padding-left: 1ex;">Hi,<br><br>in some cases we want to provide RPs with attributes but no<br></blockquote></blockquote></blockquote>user_id, which is similar to AX. How can this be realized in Connect?<br>The scope value "openid" activates the OpenID mode at the AS but it<br>also requests access to the user_id Claim. If we do not want to<br>disclose a user_id, does this mean we need to define a new, distinct<br>scope for our use case, e.g. "attribute_x"?<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #e9b96e; padding-left: 1ex;">regards,<br>Torsten.<br><hr><br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote><br></blockquote><hr><br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote><br><br></blockquote></blockquote></pre></blockquote></div></blockquote></div><br></div></body></html>