<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:764421410;
mso-list-type:hybrid;
mso-list-template-ids:-1267063112 -576427850 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-ascii-font-family:Calibri;
mso-fareast-font-family:Calibri;
mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1265990415;
mso-list-template-ids:1898713304;}
@list l1:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2
{mso-list-id:1291283966;
mso-list-template-ids:-478898396;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hello everyone! Find my two cents in in-line comments.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Bests,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Martin.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-risc <openid-specs-risc-bounces@lists.openid.net>
<b>On Behalf Of </b>Stan Bounev via Openid-specs-risc<br>
<b>Sent:</b> Tuesday, May 11, 2021 3:48 PM<br>
<b>To:</b> Openid-specs-risc <openid-specs-risc@lists.openid.net><br>
<b>Subject:</b> Re: [Openid-specs-risc] Credential Compromised open questions<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">Hi All, <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I want to ask for your feedback on two open questions from today’s discussion.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoPlainText" style="mso-list:l0 level1 lfo3">How do you identify the account / provider of the subject principal where the credential compromise has taken place?<o:p></o:p></li></ol>
<p class="MsoPlainText">[Stan]: The difficulty here is that somebody with <a href="mailto:joesmith@example.com">
joesmith@example.com</a> could have used the same email to open an account in additional services, such as Test.com. The compromised credentials service (aka identity threat intelligence service) would receive an email with domain ‘example.com’ which could
apply both for example.com and test.com. In reality, a compromised credential service would get such information from the actor who is providing the data. In this case, the compromised credential service will designate the account/provider where the compromised
occurred. We will need to make sure we have a field for that.<o:p></o:p></p>
<p class="MsoPlainText"><b><i><span style="color:#1F497D"><o:p> </o:p></span></i></b></p>
<p class="MsoPlainText"><i><span style="color:#1F497D">[MG] As discussed during the meeting, the “iss” (Issuer) claim of the event identifies the service provider publishing the SET, and thus cannot be used for the purpose mentioned here. One of the suggestions
was then to use the Issuer claim of the Subject Identifier. It’s worth mentioning that in that case, a Subject Identifier of type “Email Identifier” (“email”) or “Phone Number Identifier” (“phone_number”) won’t be precise enough, and instead one of the type
“Issuer and Subject Identifier” ("iss_sub") would be required.</span></i><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoPlainText" style="mso-list:l0 level1 lfo3">How do you identify the type of credential associated with the subject principal that has been compromised?<o:p></o:p></li></ol>
<p class="MsoPlainText">[Stan]: The suggestion today was to see if we can expand the definition and have not only email, but also phone UUID, private key, admin token, etc. My take is that in order to a have additional such identifiers we need to have a way
to describe them. We can do that already with email <a href="mailto:joe.smith@example.com">
joe.smith@example.com</a>; and we can add also a phone +(001) 212 212 2122;<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">It will be more challenging to do it for private keys, admin tokens, etc. as they are not with a standardized in length. If you have a suggestion how we can define them, it makes sense to add them. Otherwise, I suggest we stick with
email and phone. From experience, we will be able to capture 90% of compromised credentials as keys, tokens, etc., are not that popular.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">This is a more narrow approach, but will allow us to make the spec easier to understand, implement and we’ll be able to move faster with the approval.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><i><span style="color:#1F497D">[MG] Agree with limiting the subject identifiers to email and eventually phone number, as it will cover the more prevalent cases as well as avoid entering into further challenges. However, in any of those
cases and having agreed on that an email address or a phone number on it’s own doesn’t identify a credential, it should be important to clarify the event that we are describing.
</span></i><b><i><span style="color:#1F497D">My understanding</span></i></b><i><span style="color:#1F497D"> is that with the current proposal the event will signal the receiver that
</span></i><b><i><span style="color:#1F497D">one</span></i></b><i><span style="color:#1F497D"> credential associated with the subject principal at the provider of reference (if the issuer approach is adopted) has been compromised. We won’t be able to identify
</span></i><b><i><span style="color:#1F497D">what</span></i></b><i><span style="color:#1F497D"> credential was compromised. Doing so will require us to come up with a mechanism to define the types of credentials and to identify the compromised credential itself
(and eventually refer to a normative definition of credential as well).</span></i><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Let me know what you think.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Stan<o:p></o:p></p>
</div>
</body>
</html>