<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Re-sending to RISC group. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Apologies to fastfed. <br><br>Phil</div><div><br>Begin forwarded message:<br><br></div><blockquote type="cite"><div><b>From:</b> Phil Hunt <<a href="mailto:phil.hunt@oracle.com">phil.hunt@oracle.com</a>><br><b>Date:</b> December 12, 2017 at 9:04:14 AM PST<br><b>To:</b> <a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a><br><b>Subject:</b> <b>Multi subject discuss?</b><br><br></div></blockquote><blockquote type="cite"><div><span>It has been raised by marius on the secevents list that multi subjects in risc sets is a requirement which has not been discussed here. </span><br><span></span><br><span>As we have not discussed this, I propose we do so. </span><br><span></span><br><span>I have grave concerns about possible privacy implications particular if third party security providers are involved. </span><br><span></span><br><span>I believe for any stream, transmitters and receivers must negotiate a single subject identifier to use. This can become a requirement for config eg as an extension to stream config </span><br><span></span><br><span>Ps i also support single profile option in stream config per discussion with annabelle. </span><br><span></span><br><span>I also support a standard subject claim but because of issues like multi subject, i do not support it being part of the main set draft. </span><br><span></span><br><span>I think standard subject is also useful for access tokens/id tokens and may pave the way for single subject sets in risc. </span><br><span></span><br><span>Best,</span><br><span></span><br><span>Phil</span></div></blockquote></body></html>