<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1596011093;
mso-list-template-ids:701909318;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a new PR about the ‘compromised’ use case. I would like to ask you if you could provide feedback -
<a href="https://bitbucket.org/openid/risc/pull-requests/2/add-compromised-credential-use-case/diff">
https://bitbucket.org/openid/risc/pull-requests/2/add-compromised-credential-use-case/diff</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is more detail that also provides some of the main points that will be included in a potential ‘compromised’ event.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="color:black;margin-top:0in;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo1">
Transmitter finds compromised credential with the RP domain<o:p></o:p></li><li class="MsoListParagraph" style="color:black;margin-top:0in;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo1">
Transmitter sends the compromised event that includes the identifier<o:p></o:p></li><li class="MsoListParagraph" style="color:black;margin-top:0in;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo1">
RP acknowledges this is or it is not a valid identifier (user ID/email address).<o:p></o:p></li><li class="MsoListParagraph" style="color:black;margin-top:0in;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo1">
RP either makes a to request to transmitter to get an identifier’s attribute (password) or not to do that<o:p></o:p></li><li class="MsoListParagraph" style="color:black;margin-top:0in;margin-bottom:0in;margin-bottom:.0001pt;mso-list:l0 level1 lfo1">
If RP makes a request, the transmitter sends: a)identifier; b) credential type, e.g. ‘password;’ c) credential hash; d) hash method.<o:p></o:p></li></ol>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">#5 above could be a subject of an additional agreement between the transmitter and RP. The main reason for a separate agreement is that there are multiple ways the attribute could be sent based on receivers systems
and regulations. My question to the group is if you agree to have a separate agreement outside of the event type or to find a way to standardize how to transmit the compromised attribute (i.e. password).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Stan<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Openid-specs-risc <openid-specs-risc-bounces@lists.openid.net> on behalf of Stan Bounev via Openid-specs-risc <openid-specs-risc@lists.openid.net><br>
<b>Reply-To: </b>Stan <stanb@vericlouds.com><br>
<b>Date: </b>Tuesday, May 26, 2020 at 10:09 AM<br>
<b>To: </b>Atul Tulshibagwale <atultulshi@google.com>, Openid-specs-risc <openid-specs-risc@lists.openid.net><br>
<b>Subject: </b>Re: [Openid-specs-risc] Feedback on the draft spec<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I had some issues with the permissions to Bitbucket and was not able to add the ‘compromised’ use case to the RISC spec. I just asked Marius if he could do it before the meeting at 10am.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">In case he is not able to, I’ve attached the use case to this email.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I will be available during the meeting and after that to address questions about the use case.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Stan<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Openid-specs-risc <openid-specs-risc-bounces@lists.openid.net> on behalf of Atul Tulshibagwale via Openid-specs-risc <openid-specs-risc@lists.openid.net><br>
<b>Reply-To: </b>Atul Tulshibagwale <atultulshi@google.com><br>
<b>Date: </b>Tuesday, May 26, 2020 at 6:45 AM<br>
<b>To: </b>Openid-specs-risc <openid-specs-risc@lists.openid.net><br>
<b>Subject: </b>[Openid-specs-risc] Feedback on the draft spec</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<div>
<p class="MsoNormal">Seeing some excellent feedback on the draft spec in the Google Doc below. Thanks to all those who have reviewed it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">For those who haven't seen it yet: If possible, please review the spec and add your feedback / comments before the call today, so that we can focus more on the feedback rather than introducing the changes in the call.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:solid #DDDDDD 1.0pt;padding:4.0pt 4.0pt 4.0pt 4.0pt;max-height:18px">
<p class="MsoNormal" style="background:whitesmoke"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><a href="https://docs.google.com/document/d/1EShCGEAI_m3Syu5ZF-zcK-dAxEh4p_HrVNQA4kjKtOM/edit?usp=drive_web" target="_blank"><span style="border:none windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="_x0000_i1025" src="cid:~WRD0000.jpg" alt="Image removed by sender."> </span><span style="color:#1155CC;border:none windowtext 1.0pt;padding:0in;text-decoration:none">openid-sse-profile-draft</span></a></span></b><o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Atul<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>