<html><head></head><body><div dir="ltr"><div dir="ltr">The way the protocol is defined the user has to take action (In ble you are near to each other physically and you do know to whom you are connecting) in order to connect. So in its core the user is aware and is the initiator of the connection. So once the user is aware of this the wallet identifies itself to the verifier. </div><div dir="ltr"><br></div><div dir="ltr">Now if any one creates the QR and sticks it on a wall of a stadium entrance and waits for his bait then all he could get is the basic wallet information, remaining trust is based on the wallet knowing the relying party, which would not be possible for the verifier to prove (section 7.2).<br clear="all"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><br></div><div>Will you consider the basic information about the wallet as a PII? </div><div><br></div><div>Thanks</div><div>Sasikumar Ganesan</div><div><a href="https://github.com/gsasikumar/" target="_blank">https://github.com/gsasikumar/</a><br></div><div><a href="https://www.linkedin.com/in/sasikumarganesan/" target="_blank">https://www.linkedin.com/in/sasikumarganesan/</a></div><div><a href="https://twitter.com/g_sasi_kumar" target="_blank">https://twitter.com/g_sasi_kumar</a><br></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jul 29, 2023 at 12:22 AM Tom Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab_at_lists.openid.net_sasi@duck.com">openid-specs-ab_at_lists.openid.net_sasi@duck.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div style="display:none;font-size:1px;background:rgb(255,255,255);color:rgb(0,0,0);line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden"> I have a fundamental problem with OpenID for Verifiable Presentations over BLE flow diagrams. It seems that the user wallet identifies itself to the verifier before the user knows the identifier of th </div>
</div><div dir="ltr"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><span style="background-color:rgb(242,242,242);color:rgba(0,0,0,0.9);font-family:-apple-system,system-ui,system-ui,"Segoe UI",Roboto,"Helvetica Neue","Fira Sans",Ubuntu,Oxygen,"Oxygen Sans",Cantarell,"Droid Sans","Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Lucida Grande",Helvetica,Arial,sans-serif;font-size:14px;white-space:pre-wrap">I have a fundamental problem with </span><span style="font-family:"Noto Sans",Arial,Helvetica,sans-serif">OpenID for Verifiable Presentations over BLE flow diagrams.</span></div><div>It seems that the user wallet identifies itself to the verifier before the user knows the identifier of the verifier.</div><div>There is a statement about the advertisement "5.2 <span style="font-family:"Noto Sans",Arial,Helvetica,sans-serif;font-size:14px">The QR Code contains the name and the ephemeral public key of the Verifier."</span></div><div>Is the presumption that the physical context of the QR code is sufficient?.</div><div>It seems that anyone could go about pasting QR codes in any place that lead to attack sites.</div><div><br></div><div>I am creating some BLE code to see if section 5.1 is any better. It is not clear from the docs that i have what information is in the ad.</div><div><span style="background-color:rgb(242,242,242);color:rgba(0,0,0,0.9);font-family:-apple-system,system-ui,system-ui,"Segoe UI",Roboto,"Helvetica Neue","Fira Sans",Ubuntu,Oxygen,"Oxygen Sans",Cantarell,"Droid Sans","Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Lucida Grande",Helvetica,Arial,sans-serif;font-size:14px;white-space:pre-wrap"> </span>..tomj</div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 25, 2023 at 4:37 AM Torsten Lodderstedt via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div name="messageBodySection">
<div dir="auto">Hi all, <br>
<br>
the initial revision of the OpenID for Verifiable Presentations over BLE draft is now available <a href="https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-over-ble-1_0.html" target="_blank">https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-over-ble-1_0.html</a>.<br>
<br>
Please review the specification and give feedback either here on the list or through issues at <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam" target="_blank">https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam</a>. <br>
<br>
Thanks in advance, <br>
Torsten. </div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div></div>
</body></html>