<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=blue style='word-wrap: break-word;-webkit-nbsp-mode: space;
-webkit-line-break: after-white-space'>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Hi David, that call was actually scheduled
on 10/22 based on your schedule and I thought you were going to let everyone on
this list know about it in case others wanted to participate. Unfortunately it
turned out there was some confusion about the call time to do a DST bug so some
people dialed-in at 12 and some folks dialed in at 1. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>It sounds like both meetings were
productive but unfortunately I don’t think we have consensus yet. Please
see attached email with feedback on the meeting notes that Mike posted. Since some
folks involved in the discussion cannot participate on this list until IPR
policy is finalized, we decided that we would discuss this on the OSIS-general
alias, especially to the extent that this really impacts interoperability.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Basically I believe the following are
still two main issues:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>1 – Definition of “phishing
resistant” and the classification proposed for the appendix.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>2 – Proposal for a different spec to
communicate actual auth model used. We would like to see this in the PAPE spec
though potentially optional (in the spirit of compromise and consensus ;-) To
introduce a new spec is too much overhead and to try to do it in attribute
exchange introduces interop issues, not to mention that attribute spec has not
been finalized yet.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>So with all that said, I don’t agree
we are ready for a new draft quite yet…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Regards,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Roxana<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<p><strong><b><font size=2 color=gray face="Times New Roman"><span
style='font-size:10.0pt;color:gray'>Roxana Bradescu | VeriSign
Innovation | office: 650-426-4489 | mobile: 650-576-9262 |
rbradescu@verisign.com</span></font></b></strong><font color=navy><span
style='color:navy'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'> </span></font><o:p></o:p></p>
</div>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> specs-bounces@openid.net
[mailto:specs-bounces@openid.net] <b><span style='font-weight:bold'>On Behalf
Of </span></b>David Recordon<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, November 05, 2007
5:37 AM<br>
<b><span style='font-weight:bold'>To:</span></b> OpenID specs list<br>
<b><span style='font-weight:bold'>Subject:</span></b> Fwd: OSIS PAPE call
results</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Hey all,<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>It turned out that from the OSIS interoperability event in <st1:City
w:st="on"><st1:place w:st="on">Barcelona</st1:place></st1:City> a call was
scheduled to discuss PAPE issues from the interop. I heard about the call
a few minutes before, but Mike, Johnny, and I had a really productive call.
If no one disagrees, we should get these edits into the spec and release
draft 3.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Thanks,<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>--David<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Begin forwarded message:<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
<br>
<o:p></o:p></span></font></p>
<div>
<div>
<p class=MsoNormal><b><font size=1 color=black face=Helvetica><span
style='font-size:9.0pt;font-family:Helvetica;color:black;font-weight:bold'>From:
</span></font></b><font size=1 face=Helvetica><span style='font-size:9.0pt;
font-family:Helvetica'>Mike Jones <<a
href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><b><font size=1 color=black face=Helvetica><span
style='font-size:9.0pt;font-family:Helvetica;color:black;font-weight:bold'>Date:
</span></font></b><font size=1 face=Helvetica><span style='font-size:9.0pt;
font-family:Helvetica'>November 1, 2007 10:04:02 PM GMT+01:00</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><b><font size=1 color=black face=Helvetica><span
style='font-size:9.0pt;font-family:Helvetica;color:black;font-weight:bold'>To: </span></font></b><font
size=1 face=Helvetica><span style='font-size:9.0pt;font-family:Helvetica'>"<a
href="mailto:david@sixapart.com">david@sixapart.com</a>" <<a
href="mailto:david@sixapart.com">david@sixapart.com</a>>, Johnny Bufu <<a
href="mailto:johnny@sxip.com">johnny@sxip.com</a>>, "<a
href="mailto:osis-general@netmesh.org">osis-general@netmesh.org</a>" <<a
href="mailto:osis-general@netmesh.org">osis-general@netmesh.org</a>></span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><b><font size=1 color=black face=Helvetica><span
style='font-size:9.0pt;font-family:Helvetica;color:black;font-weight:bold'>Subject:
</span></font></b><b><font size=1 face=Helvetica><span style='font-size:9.0pt;
font-family:Helvetica;font-weight:bold'>OSIS PAPE call results</span></font></b><o:p></o:p></p>
</div>
<div style='min-height: 14px'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
<span style='orphans: 2;text-align:auto;widows: 2;-webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0;word-spacing:0px'>
<div link=blue vlink=blue style='word-wrap: break-word;-webkit-nbsp-mode: space;
-webkit-line-break: after-white-space'>
<div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Today we held the call discussing OSIS
feedback on the PAPE spec. Topics covered and recommendations made on the
call were:</span></font><font color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- Authorization decisions should be made
solely by the relying party. The identity provider should accurately
report the status of all policies requested by the relying party that the
authentication complies with and may also choose to report the status of any
policies that apply that were not explicitly requested. The policies are
not mutually exclusive and no relationship between the different policies
should be implied. A clarification to this effect should be added to the
draft.</span></font><font color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- There was a request for a definition of
Active Authentication as used in the auth_time element description.
Intuitively, this involves at least having the user being at the machine as a
participant in the authentication interaction in some manner. We agreed
that we should look for an existing definition of active authentication that
appears to apply.</span></font><font color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- The table in Appendix A.1.1 of<span
class=apple-converted-space> </span><a
href="http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-02.html">http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-02.html</a><span
class=apple-converted-space> </span>needs to be updated to be consistent
with the definition in Section 4. Specifically:</span></font><font
color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
PIN and soft OTP token should not be marked as phishing-resistant.</span></font><font
color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
PIN and hard OTP token should not be marked as phishing-resistant.</span></font><font
color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
Information Cards should be added and listed as phishing-resistant.</span></font><font
color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
Active password managers that only release the password to the correct site
should be listed as phishing-resistant.</span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- If relying parties and OPs want to
communicate actual authentication methods used, that should happen via a
different spec than PAPE. Then the market can decide whether to use PAPE,
this spec, both, or neither. (However some in the group have both privacy
concerns about this and concerns about enabling attackers by giving them
additional information to use in their attacks.)</span></font><font
color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Finally, while we failed to discuss this
on the call, I also believe that:</span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
PIN and digital certificate via HTTPS is phishable if the same certificate
value is released to every site.</span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
PIN and digital certificate via HTTPS is not phishable if a different
certificate value is released to every site.</span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>and that the table should be updated accordingly
in this case as well. Someone who's an expert in this method should pipe
in and provide guidance.</span></font><font color=black><span style='color:
black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
Thanks all!</span></font><font color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
-- Mike</span></font><font color=black><span style='color:black'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font><font color=black><span
style='color:black'><o:p></o:p></span></font></p>
</div>
</div>
</div>
</span>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
</body>
</html>