<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">RP today has a pre-established trust with an OP, so if the user chooses a malicious OP the high chances are RPs would not pre-establish trust with that OP
and user would have to switch to a non-malicious OP. </span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-size: 12pt; color: rgb(0, 0, 0);"><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color:rgb(255, 255, 255);display:inline !important">I agree that RP knowing which provider the user is using is a good thing. </span>I
am cautioning RP against putting high level of trust in the provider information (which it would if provider information is included in `iss`), because trust with SIOP is established as hoc and is not
<span style="background-color:rgb(255, 255, 255);display:inline !important">pre-established (at least in the scenario when SIOP is on the edge device). How can RP detect I</span>f malicious provider is pretending to be a trusted provider - G00gle-authenticat0r.com
saying it is Google-authenticator? </font></div>
<div style="font-size: 12pt; color: rgb(0, 0, 0);"><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">Today, RP trusts the subject identifier because it has that pre-existing relationship with the issuer/IdP, who manages the identifiers. How can we make the reverse work -
where provider used can be trusted because </span><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">RP successfully established an ad hoc trust with the subject identifier based on cryptographic verification?</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">Best,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">Kristina</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>$B:9=P?M(B:</b> David Waite <david@alkaline-solutions.com><br>
<b>$BAw?.F|;~(B:</b> 2021$BG/(B2$B7n(B24$BF|(B 8:06<br>
<b>$B08@h(B:</b> Artifact Binding/Connect Working Group <openid-specs-ab@lists.openid.net><br>
<b>CC:</b> Kristina Yasuda <Kristina.Yasuda@microsoft.com>; Adam Lemmon <issues-reply@bitbucket.org><br>
<b>$B7oL>(B:</b> Re: [Openid-specs-ab] Issue #1208: SIOP V2 dynamic iss claim ref: REQUIRED. Issuer. MUST be https://self-issued.me/v2 (openid/connect)</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space"><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Feb 23, 2021, at 6:02 AM, Kristina Yasuda via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div class="" style="font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none; font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">
<div class="" style="margin-top:0px; margin-bottom:0px">How would the RP check that it is a true "PWA / cloud wallet provider" and not a malicious provider pretending to be a good one?</div>
</div>
</div>
</blockquote>
</div>
<br class="">
<div class="">The RP today does not have a way to verify an OP today isn$B!G(Bt a malicious one - the user is expected to select the OP that represents them and to choose a non-malicious OP.</div>
<div class=""><br class="">
</div>
<div class="">Are you thinking of a particular attack scenario involving something like Phishing or Man-in-the-Middle?</div>
<div class=""><br class="">
</div>
<div class="">-DW</div>
</div>
</body>
</html>