<div dir="auto"><div>Interesting read.<div dir="auto"><br></div><div dir="auto">Is this requirement safe for Hybrid.</div><div dir="auto"><br></div><div dir="auto"><ul style="margin-right:0px;padding:0px 28px 0px 43px;color:rgb(51,51,51);font-family:-apple-system,blinkmacsystemfont,"segoe ui",roboto,helvetica,arial,sans-serif,"apple color emoji","segoe ui emoji","segoe ui symbol";font-size:14px;background-color:rgb(243,247,249)"><li style="line-height:1.6;margin-top:0px">Data Holders MUST request a user identifier that can uniquely identify the customer and that is already known by the customer in the redirected page</li><li style="line-height:1.6;margin-top:0px">Data Holders MUST NOT request that the customer enter an existing password in the redirected page</li><li style="line-height:1.6;margin-top:0px">Data Holders MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page</li></ul></div><div dir="auto">It implies to me that the Data Holder implicitly trusts the requester has control of the device registered for the OTP. This means I could pick up a device that I know is registered to a bank account and give access to the CDR API without providing any credentials that I own.</div><div dir="auto"><br></div><div dir="auto">I know they are trying to give easy access to the service, but surely registering first time should at least ask for credentials.</div><div dir="auto"><br></div><div dir="auto"><br></div>Regards</div><div dir="auto">Nicholas Irving<br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Mon, 30 Sep 2019, 16:34 Ralph Bragg via Openid-specs-fapi, <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-AU" link="#0563C1" vlink="#954F72">
The Australian v1.
<hr style="display:inline-block;width:98%">
<div id="m_-8471420647533567122divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Consumer Data Rights Data61 <CDR-Data61@csiro.au><br>
<b>Sent:</b> Monday, September 30, 2019 7:21:12 AM<br>
<b>To:</b> McLachlan, Terri (Data61, Eveleigh) <<a href="mailto:Terri.Mclachlan@data61.csiro.au" target="_blank" rel="noreferrer">Terri.Mclachlan@data61.csiro.au</a>><br>
<b>Subject:</b> Consumer Data Standards | September 2019 Release of Consumer Data Standards V1.0.0</font>
<div> </div>
</div>
<div>
<div class="m_-8471420647533567122WordSection1">
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">Since the previous release on 17 July of the draft Consumer Data Standards (CDS), the Data Standards Body (DSB) has continued to liaise with the broader ecosystem participants to develop and refine the standards
in support of the Australian Government’s Consumer Data Right regime. The standards are intended to make it easier and safer for consumers to share access to the data collected about them by businesses, and – with their explicit approval – to share this data
via application programming interfaces (APIs) with trusted, accredited third parties.<u></u><u></u></p>
<p class="MsoNormal"><br>
The DSB is pleased to announce the 30 September 2019 release which is expected to become the initial binding data standards for the Consumer Data Right (CDR) regime. The version 1.0.0 release of the CDS represents the baseline for implementation in accordance
with the rules and phasing timetable made by the Australian Competition and Consumer Commission (ACCC).<u></u><u></u></p>
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">We know that many in the community have been monitoring the open discussions relating to the CDS and have actively contributed to making these what they are, with feedback in workshops, on GitHub, via email and
in bilateral discussions. We thank the CDR community for their active participation which has helped develop these binding standards and encourage everyone to continue to help evolve these as living standards to serve the future CDR regime.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In this September 2019 V1.0.0 release of the standards we are publishing:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="margin-top:3.0pt;margin-bottom:3.0pt;line-height:110%">
A non-technical summary of outcomes for each work stream, see attached;<u></u><u></u></li><li class="MsoNormal" style="margin-top:3.0pt;margin-bottom:3.0pt;line-height:110%">
The latest version of the <a href="https://consumerdatastandardsaustralia.github.io/standards/" target="_blank" rel="noreferrer">
Consumer Data Standards</a>, containing API standards, Information Security profile and
<a href="https://consumerdatastandards.org.au/cx-standards/" target="_blank" rel="noreferrer">Customer Experience Guidelines</a>; and<u></u><u></u></li><li class="MsoNormal" style="margin-top:3.0pt;margin-bottom:3.0pt;line-height:115%;vertical-align:baseline">
<a href="https://consumerdatastandards.org.au/workinggroups/engineering/" target="_blank" rel="noreferrer">Payload validation tools</a> to aid participants in verifying conformance.<u></u><u></u></li></ul>
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">You can access the V1.0.0 of the Consumer Data Standards in full
<a href="https://consumerdatastandardsaustralia.github.io/standards/" target="_blank" rel="noreferrer">here</a>. <u></u>
<u></u></p>
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">Please note that we continue to encourage interested participants to provide on-going feedback on the Consumer Data Standards through GitHub. All such feedback will be included in the backlog list for consideration
in future versions of the standards.<u></u><u></u></p>
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">For further information or any questions, please email
<a href="mailto:cdr-data61@csiro.au" target="_blank" rel="noreferrer">cdr-data61@csiro.au</a>.<u></u><u></u></p>
<p class="MsoNormal" style="line-height:115%"><u></u> <u></u></p>
<p class="MsoNormal" style="line-height:115%">We look forward to working with everyone as we move closer to a live implementation of the standards.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Many thanks and regards<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Terri<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><b><span style="color:#2fb787">Terri McLachlan</span></b><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black">Secretariat Liaison Manager | Consumer Data Standards</span><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">CSIRO | Data61</span></b><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:#2fb787">E</span></b><span style="font-size:9.0pt;color:black">
<a href="mailto:terri.mclachlan@data61.csiro.au" target="_blank" rel="noreferrer"><span style="color:blue">terri.mclachlan@data61.csiro.au</span></a>
</span><b><span style="font-size:9.0pt;color:#2fb787">T</span></b><span style="font-size:9.0pt;color:black"> +61 2 9490 5722
</span><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black">Level 5, 13 Garden Street, Eveleigh NSW 2015</span><span style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black"><a href="http://Data61EmailSignature/www.data61.csiro.au" target="_blank" rel="noreferrer"><span style="color:#2fb787">www.data61.csiro.au</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span><img border="0" width="138" height="73" style="width:1.4375in;height:.7604in" id="m_-8471420647533567122_x0000_i1025" alt="Data61 | CSIRO logo" src="cid:image002.jpg@01D577A6.38002DF0"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="color:#2fb787">D61+ LIVE</span></b><b><span style="color:black"> | Carriageworks, Sydney | 2–3 October 2019 | Register
</span></b><span><a href="https://d61live.csiro.au/" target="_blank" rel="noreferrer"><b><span style="color:#2fb787">here</span></b></a><u><span style="color:black"><u></u><u></u></span></u></span></p>
<p class="MsoNormal"><i><span>Australia’s leading science, technology and innovation event</span></i><span><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank" rel="noreferrer">Openid-specs-fapi@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br>
</blockquote></div></div></div>