<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Philippe.<br>
<br>
<div class="moz-cite-prefix">Am 23.07.2015 um 14:50 schrieb
<a class="moz-txt-link-abbreviated" href="mailto:philippe.clement@orange.com">philippe.clement@orange.com</a>:<br>
</div>
<blockquote
cite="mid:14032_1437655805_55B0E2FD_14032_6792_1_BA1DE49CF3A1754F875D2318BF2412CD12FB974C@OPEXCNORM73.corporate.adroot.infra.ftgroup"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi torsten,</div>
<div> </div>
<div>Thanks a lot for this document, here are my comments </div>
<div> </div>
<div>2. Overview:</div>
<div><font color="red">- "•a RP may not process the MSISDN in
the course of the discovery process"</font></div>
<div>I think that in some cases, the RP will have this MSISDN,
and that this one will be secured at the RP by a real
secured process (challenge with a phone call, confirmation
by OTP...). Case of banks for example, but they are not
alone.</div>
<div>As this MSISDN at RP exist, we should use it to simplify
the user journey at the discovery stage and not risk to
re-ask to the user some information regarding his MNO.
Indeed, in some cases, the discovery service will have, in
absence of user/MNO data,
to ask to the user pieces of information (MSISDN,
MCC/MNC...).</div>
<div>This could be added in § 2.1 C : "<font face="Verdana"
size="2"><span style="font-size:10pt;">Moreover, the
client may pass MCC, MNC or IMSI as part of the
discovery request.</span></font>"</div>
</span></font></blockquote>
<br>
make sense. I just created a new issue and added your and
Sebastian's comments to it (and added placeholders for a msisdn
parameter to both requests). I'm open to this enhancements as it
would improve UX in the same way as the encrypted login hint. <br>
<br>
<font size="2"></font>
<blockquote
cite="mid:14032_1437655805_55B0E2FD_14032_6792_1_BA1DE49CF3A1754F875D2318BF2412CD12FB974C@OPEXCNORM73.corporate.adroot.infra.ftgroup"
type="cite"><font face="Calibri" size="2"><span
style="font-size:11pt;">
<div> </div>
<div><font color="red">- "<font size="2"><span
style="font-size:10.5pt;">OpenID Connect Clients using
this specification are encouraged to use the OpenID
Account chooser service [Account.Chooser]. This allows
them to bypass discovery for users that already
have account information cached.</span></font>"</font></div>
<div>Are we confident that Account Chooser can endorse the
discovery mechanism of an MNO for a specific user ? In other
words, do we know exactly what should be the changes at
Account Chooser level and at MNO level to bypass the
discovery process ?</div>
<div> </div>
</span></font></blockquote>
<br>
As far as I understand, there are two extensions required:<br>
- a represention of the user id, which can only be interpreted by
the OP<br>
- a description of the user id for display in the account chooser UI
(e.g. MSISDN with some digests replaced by stars) <br>
@John: is that correct? Do you know the current status of those
extensions?<br>
<br>
best regards,<br>
Torsten.<br>
<br>
<blockquote
cite="mid:14032_1437655805_55B0E2FD_14032_6792_1_BA1DE49CF3A1754F875D2318BF2412CD12FB974C@OPEXCNORM73.corporate.adroot.infra.ftgroup"
type="cite"><font face="Calibri" size="2"><span
style="font-size:11pt;">
<div>Hope this helps,</div>
<div>Philippe</div>
<div> </div>
<div>-----Message d'origine-----<br>
De : Openid-specs-mobile-profile [<a moz-do-not-send="true"
href="mailto:openid-specs-mobile-profile-bounces@lists.openid.net">mailto:openid-specs-mobile-profile-bounces@lists.openid.net</a>]
De la part de Torsten Lodderstedt<br>
Envoyé : samedi 18 juillet 2015 19:41<br>
À : <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-mobile-profile@lists.openid.net">openid-specs-mobile-profile@lists.openid.net</a><br>
Objet : [Openid-specs-mobile-profile] New Revision of
Discovery Draft</div>
<div> </div>
<div>Hi all,</div>
<div> </div>
<div>I just posted a new revision of the discovery draft to
the repository. </div>
<div>The HTML version can also be found here: </div>
<div><a moz-do-not-send="true"
href="http://openid.net/wordpress-content/uploads/2014/04/draft-mobile-discovery-01.html">http://openid.net/wordpress-content/uploads/2014/04/draft-mobile-discovery-01.html</a></div>
<div> </div>
<div>I revision reflects the current discovery design for both
web and native apps as described in the web sequence
diagrams. I also added an overview and restructured the
document.</div>
<div> </div>
<div>Please review it and give feedback to the list.</div>
<div> </div>
<div>kind regards,</div>
<div>Torsten.</div>
<div>_______________________________________________</div>
<div>Openid-specs-mobile-profile mailing list <a
moz-do-not-send="true"
href="mailto:Openid-specs-mobile-profile@lists.openid.net">Openid-specs-mobile-profile@lists.openid.net</a></div>
<div><a moz-do-not-send="true"
href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a></div>
<div> </div>
</span></font>
<pre>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</pre>
</blockquote>
<br>
</body>
</html>