[Openid-specs-fapi] EBA Opinion on eIDAS certs

Nat Sakimura nat at sakimura.org
Wed Dec 12 14:02:31 UTC 2018


On the first read, it looks like FAPI will be OK if the MTLS's client 
certs is the QSealC and the bank's web site certs is QWAC but I may be 
wrong.

Your guidance is sought > Dave

---
Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation

On 2018-12-12 22:46, Rob Otto via Openid-specs-fapi wrote:
> Dave and others - is there any scope or precedent for amending or
> extending the FAPI profiles to take this guidance into account? Could
> or should there be a "FAPI over EIDAS" profile that takes this
> guidance and turns it into something concrete and implementable by the
> industry? 
> 
> On Wed, 12 Dec 2018 at 12:35, Dave Tonge via Openid-specs-fapi
> <openid-specs-fapi at lists.openid.net> wrote:
> 
>> Hi all,
>> 
>> This has just been published:
>> 
>> 
> https://eba.europa.eu/-/eba-publishes-an-opinion-on-the-use-of-eidas-certificates-under-psd2
>> [1]
>> 
>> The EBA are strongly advocating message signing as well as mutual
>> TLS.
>> 
>> --
>> 
>> Dave Tonge
>> CTO
>> [2]
>> 
>> Moneyhub Financial Technology, 5th Floor, 10 Temple Back, Bristol,
>> BS1 6FLt: +44 (0)117 280 5120
>> 
>> Moneyhub Enterprise is a trading style of Moneyhub Financial
>> Technology Limited which is authorised and regulated by the
>> Financial Conduct Authority ("FCA"). Moneyhub Financial Technology
>> is entered on the Financial Services Register (FRN 809360) at
>> fca.org.uk/register [3]. Moneyhub Financial Technology is
>> registered in England & Wales, company registration
>> number  06909772 .
>> Moneyhub Financial Technology Limited 2018 ©
>> 
>> DISCLAIMER: This email (including any attachments) is subject to
>> copyright, and the information in it is confidential. Use of this
>> email or of any information in it other than by the addressee is
>> unauthorised and unlawful. Whilst reasonable efforts are made to
>> ensure that any attachments are virus-free, it is the recipient's
>> sole responsibility to scan all attachments for viruses. All calls
>> and emails to and from this company may be monitored and recorded
>> for legitimate purposes relating to this company's business. Any
>> opinions expressed in this email (or in any attachments) are those
>> of the author and do not necessarily represent the opinions of
>> Moneyhub Financial Technology Limited or of any other group company.
>> _______________________________________________
>> Openid-specs-fapi mailing list
>> Openid-specs-fapi at lists.openid.net
>> http://lists.openid.net/mailman/listinfo/openid-specs-fapi [4]
> 
> --
> 
>  		 [5] [5]
> 
>  Rob Otto
>  EMEA Field CTO/Solutions Architect
>  robotto at pingidentity.com
> 
>  c: +44 (0) 777 135 6092
> 
>  		Connect with us:
>  		 [6] [7] [8] [9] [10] [11] [12]
> 
>  [13]
>  _CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly
> prohibited.  If you have received this communication in error, please
> notify the sender immediately by e-mail and delete the message and any
> file attachments from your computer. Thank you._
> 
> Links:
> ------
> [1]
> https://eba.europa.eu/-/eba-publishes-an-opinion-on-the-use-of-eidas-certificates-under-psd2
> [2]
> http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A
> [3] http://fca.org.uk/register
> [4] http://lists.openid.net/mailman/listinfo/openid-specs-fapi
> [5] https://www.pingidentity.com
> [6]
> https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm
> [7] https://www.linkedin.com/company/21870
> [8] https://twitter.com/pingidentity
> [9] https://www.facebook.com/pingidentitypage
> [10] https://www.youtube.com/user/PingIdentityTV
> [11] https://plus.google.com/u/0/114266977739397708540
> [12] https://www.pingidentity.com/en/blog.html
> [13]
> https://www.google.com/url?q=https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/faqs/en/consumer-attitudes-post-breach-era-3375.pdf?id%3Db6322a80-f285-11e3-ac10-0800200c9a66&source=gmail&ust=1541693608526000&usg=AFQjCNGBl5cPHCUAVKGZ_NnpuFj5PHGSUQ
> 
> _______________________________________________
> Openid-specs-fapi mailing list
> Openid-specs-fapi at lists.openid.net
> http://lists.openid.net/mailman/listinfo/openid-specs-fapi


More information about the Openid-specs-fapi mailing list