<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Thu, May 18, 2017 at 10:34 AM, Richard Backman, Annabelle <span dir="ltr"><<a href="mailto:richanna@amazon.com" target="_blank" class="gmail-cremed gmail-cremed cremed">richanna@amazon.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="white" lang="EN-US">
<div class="gmail-m_-2593517334383075933WordSection1"><span class="gmail-">
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">></span> <span style="font-size:11pt;font-family:calibri">
only the sofisticated receivers will have to look at the nested attributes, very unlikely they will have a problem with that<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">I don’t agree with this. The three reason categories represent distinct scenarios which should elicit different responses from receivers. In the nested “reason” attribute design, an unsophisticated
receiver who looked only at the event name would necessarily treat all account_disabled events the same, whether the account was disabled due to compromise, bot-like behavior, or any other reason. That might be fine if the client’s common response is to prompt
the user to provide an alternative recovery mechanism (i.e. assume reason = “other”), but if their common response is to disable the user’s account on their side (i.e. assume reason = “compromise” or “bot”) that would be disastrous.</span></p></div></div></blockquote><div><br></div><div>Sure, but I think it is unlikely that reason will be assumed to default to hijacking, especially by a receiver that knows how to react to hijacking events (they will also look for other nested attributes like timestamps).</div><div><br></div><div>The opposite error is for receivers to completely ignore hijacking events (because they don't have an abuse system) not realizing that they are also signals that accounts are disabled. I find this error way more likely. </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div class="gmail-m_-2593517334383075933WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">Distinct names like account_disabled_bot, account_disabled_hijack*, and account_disabled_other make it clear to the reader that these represent semantically different scenarios that may
require different responses.</span></p></div></div></blockquote><div><br></div><div>They are different scenarios when it comes to abuse and they are the same scenario when it comes to account state (or session management).</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div class="gmail-m_-2593517334383075933WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">* Assuming that account_disabled_hijack is a distinct event from account_locked.</span></p></div></div></blockquote><div><br></div><div>You mean that both account_disabled_hijack and account_locked are sent?</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div class="gmail-m_-2593517334383075933WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><span class="gmail-HOEnZb"><font color="#888888"><u></u><u></u></font></span></span></p><span class="gmail-HOEnZb"><font color="#888888">
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal">-- <u></u><u></u></p>
<p class="MsoNormal">Annabelle Richard Backman<u></u><u></u></p>
</div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-family:calibri;color:black">From: </span>
</b><span style="font-family:calibri;color:black">Openid-specs-risc <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank" class="gmail-cremed gmail-cremed cremed">openid-specs-risc-bounces@<wbr>lists.openid.net</a>> on behalf of Marius Scurtescu <<a href="mailto:mscurtescu@google.com" target="_blank" class="gmail-cremed gmail-cremed cremed">mscurtescu@google.com</a>><br>
<b>Date: </b>Wednesday, May 17, 2017 at 9:52 PM<br>
<b>To: </b>"Hardt, Dick" <<a href="mailto:dick@amazon.com" target="_blank" class="gmail-cremed gmail-cremed cremed">dick@amazon.com</a>><br>
<b>Cc: </b>"<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank" class="gmail-cremed gmail-cremed cremed">openid-specs-risc@lists.<wbr>openid.net</a>" <<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank" class="gmail-cremed gmail-cremed cremed">openid-specs-risc@lists.<wbr>openid.net</a>><br>
<b>Subject: </b>Re: [Openid-specs-risc] Account State Events Format<u></u><u></u></span></p>
</div></font></span><div><div class="gmail-h5">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Yes, this could be a drawback, but I really don't think the extra level is a significant issue for several reasons:
<u></u><u></u></p>
<div>
<p class="MsoNormal">- almost for sure the hijacking and bot events in particular will need other nested attributes like timestamps (time of hijacking and time of disabling the account)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- only the sofisticated receivers will have to look at the nested attributes, very unlikely they will have a problem with that<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- most likely libraries will be used, exposing the attributes should be no issue
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- the whole SET is already nested several levels, people know how to parse JSON, even if a receiver is writing its own code to parse, how likely it is they will have issues?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">On the other hand, I am trying to prevent a naive receiver that only cares about session handling to naively look only for "<a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a>"
and miss the other events because they have a suffix, or because they look funny.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Marius<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, May 17, 2017 at 5:32 PM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" class="gmail-cremed gmail-cremed cremed">dick@amazon.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">I’m not super keen on having second layer of information about an event as it adds complexity, and this seems like the only place
we want to do it. (I do think you proposed one other place)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri">An alternative way of providing the additional information is to append chars to the string. For example</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"><a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a></span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri"><a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a>_bot</span></b><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri"><a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a>_hijacking</span></b><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri"><a href="http://schemas.openid.net/risc/event-type/account_enabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>enabled</a></span></b><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri"> </span></b><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri">This lets developers that only care about
<a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">
http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a> to look at events that start with that, rather than it being a JSON object.</span></b><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri;color:rgb(136,136,136)"> </span></b><span style="color:rgb(136,136,136)"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri;color:rgb(136,136,136)">/Dick</span></b><span style="color:rgb(136,136,136)"><u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri"> </span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
On 5/17/17, 5:23 PM, someone claiming to be "Openid-specs-risc on behalf of Marius Scurtescu" <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank" class="gmail-cremed gmail-cremed cremed">openid-specs-risc-bounces@<wbr>lists.openid.net</a> on behalf of
<a href="mailto:mscurtescu@google.com" target="_blank" class="gmail-cremed gmail-cremed cremed">mscurtescu@google.com</a>> wrote:<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
At the face-to-face a couple of weeks ago and also on Monday during our call we talked about RISC events that reflect an account state change between disabled and enabled. For example, account hijacked / recovered, account deleted / undeleted, etc.
<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
On one hand there are privacy concerns, and for example if a user violated ToS with a provider then that fact should not be disclosed (I think we have agreement here).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
On the other had at least with some of the event we do want to be very specific so abuse systems get a quality signal.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
So far the agreement was that hijacking and accounts created by bots need a distinct signal, everything else can use a generic one.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
I am proposing the following format:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
1. All of these events will use these two event type URIs:<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<a href="http://schemas.openid.net/risc/event-type/account_enabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>enabled</a><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
2. For hijacking and bot created the transmitter should add a nested attribute called "reason" with values like "hijacking" and "bot"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
An example:<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier">{</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "iss": "<a href="https://server.example.com" target="_blank" class="gmail-cremed gmail-cremed cremed">https://server.example.com</a>",</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "sub": "248289761001",</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "aud": "s6BhdRkqt3",</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "iat": 1471566154,</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "jti": "bWJq",</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "events": {</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "<a href="http://schemas.openid.net/risc/event-type/account_disabled" target="_blank" class="gmail-cremed gmail-cremed cremed">http://schemas.openid.net/<wbr>risc/event-type/account_<wbr>disabled</a>": </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> {</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> "reason": "hijacking",</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> }</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier"> }</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<span style="font-family:courier">}</span><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
We can define more values for "reason" and transmitter could chose to provide them. The more distinct events are provided the easier it is to identify the ToS cases through elimination, so there should be a good reason to be specific (if ToS privacy is a concern).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
Sounds good? Thoughts?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
There are other ways to capture these requirements (distinct URIs for hijacking and bot or multiple URIs), but this is the most concise and the safest for developers who are only interested in account state (so they don't have to deal with event URIs they don't
fully understand or care about).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
<u></u><u></u></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">
Marius<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</blockquote></div><br></div></div>