<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>Dear all,</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Please find below the preliminary minutes of our MODRNA call on Dec 11th 2018</div>
<div>Please let me know of errors or misunderstandings in the feedback</div>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>Roll Call</b></span></font></div>
<ol style="margin:0;padding-left:36pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Dave.Tonge (Moneyhub) ; </li><li style="margin-top:5pt;margin-bottom:5pt;">Philippe Clement (Orange)</li><li style="margin-top:5pt;margin-bottom:5pt;">Geoffrey Graham</li><li style="margin-top:5pt;margin-bottom:5pt;">Jörg (DT</li><li style="margin-top:5pt;margin-bottom:5pt;">Joseph Heenan</li><li style="margin-top:5pt;margin-bottom:5pt;">Petteri (Ubisecure)</li><li style="margin-top:5pt;margin-bottom:5pt;">Bjorn Hjelm (Verizon)</li><li style="margin-top:5pt;margin-bottom:5pt;">Brian Campbell (Ping Identity)</li><li style="margin-top:5pt;margin-bottom:5pt;">Takahiko Kawasaki</li><li style="margin-top:5pt;margin-bottom:5pt;">John Bradley</li></ol>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>Adoption of the Agenda [Bjorn/John]</b></span></font></div>
<div>agreed</div>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>External Organizations</b></span></font></div>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>GSMA [Siva]</b></span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;">Not addressed</div>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>Working Group Updates</b></span></font></div>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>FAPI WG [Dave]</b></span></font></div>
<div>Nothing to mention</div>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>Spec. Status</b></span></font></div>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>CIBA C</b><b>ore/MODRNA [Dave/Brian/Gonzalo/Axel]</b></span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;">Core profile is closed to be ready for implementers draft</div>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>Authentication Profile [Joerg]</b></span></font></div>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">2 things to discuss in the issue tracking:</li><li style="margin-top:5pt;margin-bottom:5pt;"><a href="https://bitbucket.org/openid/mobile/issues/39/error-non-error-handling-in-case-op-cannot"><font size="2" color="#172B4D"><span style="font-size:10.5pt;background-color:whitesmoke;"><u>#39: Error/non-error
handling in case OP cannot fulfill RP requirements</u></span></font></a><font size="2" color="#555555"><span style="font-size:11pt;"> </span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font size="2" color="#172B4D"><span style="font-size:10.5pt;background-color:whitesmoke;"><u>#43: Additional security considerations/mitigations regarding phishing of OOB authentication </u></span></font></li><li style="margin-top:5pt;margin-bottom:5pt;">need feedback before closing</li></ul>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>Issue Tracker</b></span></font></div>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>CIBA [Dave/Brian/Gonzalo/Axel]</b></span></font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;"><a href="https://bitbucket.org/openid/mobile/issues/124/privacy-considerations-and-identifiers"><font face="Arial" size="2" color="#172B4D"><span style="font-size:10.5pt;background-color:whitesmoke;"><u>#124: Privacy
Considerations and Identifiers</u></span></font></a><font face="Arial" color="#1F497D"> </font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">The 3 ways for a public identifier reach consensus.</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">Text about security has been inserted into the pull request. </span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">Minor editorial changes to </span></font><font face="Arial" size="2"><span style="font-size:10pt;">add.</span></font></li></span></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"><a href="https://bitbucket.org/openid/mobile/issues/125/ciba-pragma-no-cache"><font face="Arial" size="2" color="#172B4D"><span style="font-size:10.5pt;"><u>#125:
CIBA: Pragma: no-cache</u></span></font></a></span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;">No technical reasons to use it. We shouldn’t propagate it.</div>
<div style="margin-top:5pt;margin-bottom:5pt;">No objection to close these issues. Let people have a review of the specs. If no further objection, we’ll go for implementers draft.</div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font size="2"><span style="font-size:11pt;">The sequence of further operations is then:</span></font></div>
<ul style="margin:0;padding-left:72pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Issue 125 to close</li><li style="margin-top:5pt;margin-bottom:5pt;">Issue 124 to merge into the pull request.</li><li style="margin-top:5pt;margin-bottom:5pt;">Bjorn to see the proper wordings of the name of the spec with Mike and confirm to Dave.</li><li style="margin-top:5pt;margin-bottom:5pt;">Dave to change the name of the spec.</li><li style="margin-top:5pt;margin-bottom:5pt;">Bjorn to send a note “ready for review” to the list on Friday this week.</li></ul>
<div style="margin-top:10pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>Authentication Profile [Joerg]</b></span></font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;"><a href="https://bitbucket.org/openid/mobile/issues/39/error-non-error-handling-in-case-op-cannot"><font face="Arial" size="2" color="#172B4D"><span style="font-size:10.5pt;background-color:whitesmoke;">#39: Error/non-error
handling in case OP cannot fulfill RP requirements</span></font></a></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">If the RP said acr is essential and the OP did not make it, Is it an error to feedback to the RP ? Do we rely on the OIDC core spec that could be sufficient
in terms of error handling ?</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">It seems that it is up to the RP to make the appropriate decision.</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">Joerg recommends to reject the error handling and make reference to </span></font><font face="Arial" size="2"><span style="font-size:10pt;">OpenID</span></font><font face="Arial" size="2"><span style="font-size:10pt;">
connect core.</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Wingdings" size="2"><span style="font-size:10pt;">ā</span></font><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font><font face="Arial" size="2"><span style="font-size:10pt;">Issue
to close.</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;"><a href="https://bitbucket.org/openid/mobile/issues/43/additional-security-considerations"><font face="Arial" size="2" color="#172B4D"><span style="font-size:10.5pt;background-color:whitesmoke;"><u>#43: Additional
security considerations/mitigations regarding phishing of OOB authentication</u></span></font></a></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Wingdings">ā</font><font face="Arial"> </font><font face="Arial" size="2"><span style="font-size:10pt;">Joerg to reach out to Torsten and John for inputs and proper wording.</span></font></li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">This issue is the l</span></font><font face="Arial" size="2"><span style="font-size:10pt;">ast thing to resolve before going final, then the spec to be read
by the WG.</span></font></li></span></font>
</ul>
<div style="margin-top:24pt;"><font size="4" color="#365F91"><span style="font-size:14pt;"><b>AOB</b></span></font></div>
<div>Next meeting on January 8th.</div>
<ul style="margin:0;padding-left:72pt;">
<li>John to delete the last 2018 MODRNA meeting in the calendar</li></ul>
<div><font face="Calibri" size="2" color="#365F91"><span style="font-size:11pt;"> </span></font></div>
<div>Best regards,</div>
<div>Philippe</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>