<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi torsten,</div>
<div> </div>
<div>Thanks a lot for this document, here are my comments </div>
<div> </div>
<div>2. Overview:</div>
<div><font color="red">- "•a RP may not process the MSISDN in the course of the discovery process"</font></div>
<div>I think that in some cases, the RP will have this MSISDN, and that this one will be secured at the RP by a real secured process (challenge with a phone call, confirmation by OTP...). Case of banks for example, but they are not alone.</div>
<div>As this MSISDN at RP exist, we should use it to simplify the user journey at the discovery stage and not risk to re-ask to the user some information regarding his MNO. Indeed, in some cases, the discovery service will have, in absence of user/MNO data,
to ask to the user pieces of information (MSISDN, MCC/MNC...).</div>
<div>This could be added in § 2.1 C : "<font face="Verdana" size="2"><span style="font-size:10pt;">Moreover, the client may pass MCC, MNC or IMSI as part of the discovery request.</span></font>"</div>
<div> </div>
<div><font color="red">- "<font size="2"><span style="font-size:10.5pt;">OpenID Connect Clients using this specification are encouraged to use the OpenID Account chooser service [Account.Chooser]. This allows them to bypass discovery for users that already
have account information cached.</span></font>"</font></div>
<div>Are we confident that Account Chooser can endorse the discovery mechanism of an MNO for a specific user ? In other words, do we know exactly what should be the changes at Account Chooser level and at MNO level to bypass the discovery process ?</div>
<div> </div>
<div>Hope this helps,</div>
<div>Philippe</div>
<div> </div>
<div>-----Message d'origine-----<br>
De : Openid-specs-mobile-profile [<a href="mailto:openid-specs-mobile-profile-bounces@lists.openid.net">mailto:openid-specs-mobile-profile-bounces@lists.openid.net</a>] De la part de Torsten Lodderstedt<br>
Envoyé : samedi 18 juillet 2015 19:41<br>
À : openid-specs-mobile-profile@lists.openid.net<br>
Objet : [Openid-specs-mobile-profile] New Revision of Discovery Draft</div>
<div> </div>
<div>Hi all,</div>
<div> </div>
<div>I just posted a new revision of the discovery draft to the repository. </div>
<div>The HTML version can also be found here: </div>
<div><a href="http://openid.net/wordpress-content/uploads/2014/04/draft-mobile-discovery-01.html">http://openid.net/wordpress-content/uploads/2014/04/draft-mobile-discovery-01.html</a></div>
<div> </div>
<div>I revision reflects the current discovery design for both web and native apps as described in the web sequence diagrams. I also added an overview and restructured the document.</div>
<div> </div>
<div>Please review it and give feedback to the list.</div>
<div> </div>
<div>kind regards,</div>
<div>Torsten.</div>
<div>_______________________________________________</div>
<div>Openid-specs-mobile-profile mailing list <a href="mailto:Openid-specs-mobile-profile@lists.openid.net">Openid-specs-mobile-profile@lists.openid.net</a></div>
<div><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a></div>
<div> </div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>