<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
openid/sharedsignals event <br>
<br>
Issue opened <br>
Issue Title: Guidelines for Adding Subjects to a Stream <br>
https://github.com/openid/sharedsignals/issues/289 <br>
<br>
According to the SSF specification, a receiver can add any subject to a stream. This means that the receiver can obtain events for any end-user, as long as the events are listed in `events_delivered`. Doesn’t this raise security and privacy concerns? If there
were a rule such as “only events related to the subject associated with the access token used when creating the stream will flow into that stream,” then things would be more straightforward, and there would be no risk of infringing on the security or privacy
of other users. However, the SSF specification deliberately defines an Add Subject endpoint, allowing receivers to add arbitrary subjects to a stream. It seems that, unless significant restrictions are imposed on the operation of transmitters and receivers,
security and privacy issues will arise. Are there any operational or implementation guidelines to address this?
</body>
</html>