<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060">On 12/21/15 I wrote a note proposing at least the shorter claim name “email_current” that I haven’t seen a response to. If you believe that you have go forward
with this semantically, William, can you at least use the shorter claim name “email_current” rather than the longer “email_authoritative”. Size still matters when claims are used in ID Tokens.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"><o:p> </o:p></span></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-ab [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>Nick Roy<br>
<b>Sent:</b> Monday, January 4, 2016 3:32 PM<br>
<b>To:</b> John Bradley <ve7jtb@ve7jtb.com>; William Denniss <wdenniss@google.com><br>
<b>Cc:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-ab] Proposing a new 'email_authoritative' ID Token claim<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I can't post to the list directly since I havent yet signed the IPR. I intend to do that, but I need to figure out if I can do it myself, or if Internet2 needs
to do it for me. In the meantime, William's revision looks good to me. FWIW, any account recovery protocol that would serve for re-binding a local account at the RP to federated credentials is also necessary/likely acceptable for re-linking the identity
at the RP with a different OP identity if the person so chooses.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Nick<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-family:"Calibri",sans-serif;color:black">John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>><br>
<b>Date: </b>Monday, December 21, 2015 at 7:42 PM<br>
<b>To: </b>William Denniss <<a href="mailto:wdenniss@google.com">wdenniss@google.com</a>><br>
<b>Cc: </b>"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>>, Nicholas Roy <<a href="mailto:nroy@internet2.edu">nroy@internet2.edu</a>><br>
<b>Subject: </b>Re: [Openid-specs-ab] Proposing a new 'email_authoritative' ID Token claim<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">The painful thing is that we need to move away from using email for account recovery.
<o:p></o:p></span></p>
<p><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Long term we need to consider a federated account recovery protocol potentially separate from SSO, for those RP that want to have local accounts.
<o:p></o:p></span></p>
<p><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Even if a email is bound to an account today there is no real guarantee that it will be tomorrow.
<o:p></o:p></span></p>
<p><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I see the verified flag as being good enough to subscribe the user to a mailing list and ask them if it is still there email Y/N, but not strong enough for automatic account linking.
<o:p></o:p></span></p>
<p><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">John B.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Dec 21, 2015 8:51 PM, "William Denniss" <<a href="mailto:wdenniss@google.com">wdenniss@google.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I agree that you would be authoritative in this scenario. The key is that a relationship exists between the OP and the mailbox provider to maintain identity consistency.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">This scenario definitely passes "</span><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">When this Claim Value is true, the OP asserts
that the End-User is in control of the e-mail account, and would be able to pass email verification were it to be performed at that moment."</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">Would you say that you are "managing" the mailbox, when you outsource it? Otherwise we can reword that line a bit. I basically put that there to serve as an example
of the line before, perhaps I should make that fact more clear as well. </span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Does this read better? (new text emphasized)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">email_authoritative<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">True if the OP authoritatively represents the End-User's email address; otherwise false. When this Claim Value is true, the OP asserts that the End-User is in control
of the e-mail account, and would be able to pass email verification were it to be performed at that moment.
<b>For example, </b>OPs that manage the mailbox of the e-mail address are considered authoritative, as are OPs contracted by the owner of the mailbox to provide identity services. The exact logic to determine whether the OP is authoritative is dependent upon
the trust framework or contractual agreements within which the parties are operating.<o:p></o:p></span></p>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Mon, Dec 21, 2015 at 3:01 PM, Nick Roy <<a href="mailto:nroy@internet2.edu" target="_blank">nroy@internet2.edu</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">What about the converse of 'as are OPs contracted by the owner of the mailbox to provide identity services.'? Example:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I'm an OP that outsources my email to Google (a typical scenario in higher education), but I maintain mail routing information about the target of email aliases
or outsourced mailboxes for my population within my IDMS. Am I authoritative per this definition? I think I should be.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Best,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Nick<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-family:"Calibri",sans-serif;color:black">Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>> on behalf of William Denniss <<a href="mailto:wdenniss@google.com" target="_blank">wdenniss@google.com</a>><br>
<b>Date: </b>Monday, December 21, 2015 at 1:11 PM<br>
<b>To: </b>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<b>Cc: </b>"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><br>
<b>Subject: </b>Re: [Openid-specs-ab] Proposing a new 'email_authoritative' ID Token claim<o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">This is the proposed claim definition:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">email_authoritative<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">True if the OP authoritatively represents the End-User's email address; otherwise false. When this Claim Value is true, the OP asserts that the End-User is in control
of the e-mail account, and would be able to pass email verification were it to be performed at that moment. OPs that manage the mailbox of the e-mail address are considered authoritative, as are OPs contracted by the owner of the mailbox to provide identity
services. The exact logic to determine whether the OP is authoritative is dependent upon the trust framework or contractual agreements within which the parties are operating.<o:p></o:p></span></p>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">The risk we see with email_verified is the following: user creates an account at Google, say
<a href="mailto:janelle@acme.com" target="_blank">janelle@acme.com</a>. We verify the email, and return email_verified:true forever which is valid as per spec. The user then loses control of the the email address (say it was recycled or maybe the domain itself
passed to a new owner). If an RP is using Fast IDV to do login or account recovery (as we are
<a href="https://wdenniss.com/FastIDV" target="_blank">suggesting</a>), then the owner of the Google account could potentially sign-in to accounts of the new owner of
<a href="mailto:janelle@acme.com" target="_blank">janelle@acme.com</a>. If instead, the RP were to send the user an email for account recovery, only the new owner would be able to login – so clearly there is a difference here between the email_verified claim,
and doing an email verification that moment.</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">The proposal is to add "email_authoritative" as a stronger claim of confidence on the link between the owner of the account, and the owner of the email address.
This would also rely on the existing trust framework. We would assert this on all consumer mail we host, and also any enterprises who contract us to provide identity services (i.e. as part of Google Apps for Work). In this case, if the RP were to send an
email for account recovery, the IDP is asserting that this email would go to the same user, thus for the RP, accepting this claim (from a trusted IDP) is equivalent to doing an email verification at that moment.</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:black">To me, email_verified is still useful for many cases like allowing users to subscribe to a mailing list without a manual email verification, but email_authoritative
would be more appropriate for email-based login / account recovery.</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Mon, Dec 21, 2015 at 11:32 AM, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Mike, The difference is important in new account registration.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">There is a big difference between is this the email address for the account now and, has this email ever been linked to the account.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">We always knew that email verified would be trustable from some IdP and not others. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">This is not a difference of if the IdP is trusted or not, that is a trust framework issue agreed.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">But having some IdP use email verified to indicate this is the current email vs one that was once verified will also lead to confusion and the inability to express
the difference.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Google and others have three posable states for email unverified, verified (at some date), and current (one tied to the account permanently like gmail) <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">One possibility I raised was returning the date of the email verification. The downside to that is it leaks privacy information about when the account was created.
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">A mitigation for that would be to have the IdP check on the currency of the email from time to time for account recovery, that way the date would not be tied to
account establishment.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I agree that having two similar things is not ideal, however having a overloaded meaning for one thing and no way to discover which it means is probably a larger
problem.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">John B.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Dec 21, 2015, at 4:20 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Can you post the text defining the meaning of the proposed claim to the last four review?<br>
<br>
This still seems redundant to me, for what it's worth. Of you go back to the discussions in which email_verified was defined, our was always the case that the exact semantics were going to be service dependant - and potentially also dependent on the trust framework
in place between the parties. I don't see any practical problem with you using the existing claim to meet your needs. Can you explain the problem you perceive?<br>
<br>
Whereas having two claims with almost exactly the same meaning is almost certain to cause interop problems and confusion.<br>
<br>
-- Mine<o:p></o:p></span></p>
</div>
</div>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">
<hr size="3" width="100%" align="center">
</span></div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="mailto:wdenniss@google.com" target="_blank">William Denniss</a></span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Sent:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">12/21/2015 11:08 AM</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">To:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="mailto:Michael.Jones@microsoft.com" target="_blank">Mike Jones</a></span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Cc:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a></span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Subject:
</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Re: [Openid-specs-ab] Proposing a new 'email_authoritative' ID Token claim</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Hi All,
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">We're planning to move forward with this claim in production in the new year. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Does anyone have any feedback on the semantic meaning, or the name? Once we release we can't change our production usage. So if anyone has feedback I'd prefer to
hear it now while we can still modify things, not later when finalizing the spec.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Regarding the specification required review for the IANA registry, my plan is to put it in the Fast IDV spec – this claim will be important for the security considerations
of that spec. I <a href="https://tools.ietf.org/html/rfc7519#section-10.1" target="_blank">
see</a> that "Designated Experts may approve registration once they are satisfied that such a specification will be published". How far along does the spec need to be to satisfy that requirement?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">William<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Thu, Dec 10, 2015 at 11:40 PM, William Denniss <<a href="mailto:wdenniss@google.com" target="_blank">wdenniss@google.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">We did consider that alternative, including the option of simply applying that logic to our own implementation. I believe that a new claim is the correct approach
in this instance, for a few reasons: <o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">1) the two claims are semantically different. RPs can derive use from the email_verified claim, even when they don't get a email_authoritative claim (e.g. for lower-risk
actions like users subscribing to a mailing list where a 'weaker' email verification will suffice).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">2) given the semantic difference and the fact that specs should not change, I think it's too late to redefine email_verified to mean email_authoritative. People
who have already implemented email_verified in a spec compliant way will be asserting this claim on email addresses they are not authoritative for (quite validly). If half the community then adopts the new meaning, but half retain the old, RPs won't know which
logic to apply to the different OPs, and thus may mistakenly believe when an OP asserts email_verified on an email address that they are authoritative when in fact they are not, which could ultimately lead to account compromise at the RP for that account.<o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">On Thu, Dec 10, 2015 at 10:46 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060">An alternative to defining a new claim would be to further specify the semantics of the existing one
such that it works for the use cases we’re interested in. We should definitely discuss that alternative before adding a new standard claim definition.</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> </span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> -- Mike</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a name="151c6f4ef008b399_151c6c6590022530_151c62"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> </span></a><span style="mso-bookmark:151c6f4ef008b399_151c6c6590022530_151c62"></span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> Openid-specs-ab
[mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>William Denniss<br>
<b>Sent:</b> Thursday, December 10, 2015 10:43 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] Proposing a new 'email_authoritative' ID Token claim</span><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Hi All,<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">We support the email_verified claim on our OpenID Connect endpoints today, using the
<a href="http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" target="_blank">
spec-defined</a> meaning of the claim. However, when looking at things like <a href="http://wdenniss.com/fastidv" target="_blank">
FastIDV</a>, where ID Tokens can be used for login via a trusted OP, some weaknesses of email_verified emerge. Specifically that there is no guarantee as to
<i>when</i> the email address was verified. This leads us to think that this probably isn't a strong enough assertion for login or account recovery. Typical email-based account recovery requires the user perform a fresh email verification – so using the email_verified
claim from an ID Token is technically weaker than the RP actually sending the user an email.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">In many cases though, we actually host the mailbox for the email address in question, or are otherwise
in an authoritative position to state that if the user were to do an email verification, it would pass. I believe that many other OPs would be in a similar position.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">I would like to propose a new ID Token claim to be able to assert this stronger email claim, defined
as such:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">email_authoritative<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">True if the OP authoritatively represents the End-User's email address; otherwise false. When this Claim
Value is true, the OP asserts that the End-User is in control of the e-mail account, and would be able to pass email verification were it to be performed at that moment. OPs that manage the mailbox of the e-mail address are considered authoritative, as are
OPs contracted by the owner of the mailbox to provide identity services. The exact logic to determine whether the OP is authoritative is dependent upon the trust framework or contractual agreements within which the parties are operating.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">So basically I see "email_verified" as good enough proof to allow a user to perform an action like subscribe
to a mailing list without separate email verification, but only "email_authoritative" should be used for login/account recovery purposes. Two distinct levels of proof, for widely different use-cases.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">We also considered simply re-defining our own handling of email_verified to return a more strict response
(i.e. just not asserting it for non-authoritative addresses), but I see some risks in this, for example, that other OPs will continue to assert email_verified on Gmail accounts (quite validly), and that RPs may get confused if we document different semantics
to the spec, potentially applying our logic to other OPs.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">In order to pass the specification required basis for a new public claim, I am thinking to add this new
claim to the draft FastIDV spec as it is that use-case that has sparked this requirement.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Interested to hear your thoughts on this proposal.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">Best,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">William<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">PS. Thank you John Bradley for the extremely productive conversation on this topic on the sidelines of
IETF94. Originally I was going to proposed email_hosted, but you made some good points that OPs may still be able to authoritatively represent an email address they don't host. I incorporated that feedback into this proposal.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>