IRC log of idbrowser on 2011-05-25

Timestamps are in UTC.

00:02:52 [jkmathes]

jkmathes has joined #IDBrowser

00:04:33 [wbaker]

wbaker has joined #idbrowser

00:06:17 [steve_schultze]

steve_schultze has joined #idbrowser

00:11:01 [scribe]

q+ dirk

00:11:22 [zolli]

zolli has joined #idbrowser

00:11:37 [yoiwa]

yoiwa has joined #idbrowser

00:11:44 [josephboyle]

josephboyle has joined #idbrowser

00:12:23 [mark]

mark has joined #idbrowser

00:13:52 [tlr]

tlr has joined #idbrowser

00:14:02 [tantek]

thanks scribe for fixing the perms

00:14:32 [tlr]

meeting: W3C workshop on Identity in the Browser

00:14:34 [tlr]

rrsagent, make minutes

00:14:34 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html tlr

00:16:03 [tantek]

yes, in my opinion we should introduce <input type="identity-url"> because it does incrementally improve a number of aspects of *exiting* browser login / password functionality

00:16:06 [nico]

nico has joined #idbrowser

00:16:49 [tantek]

you could use <input type="identity-url"> by itself for URL-based login systems such as OpenID or RelMeAuth

00:16:52 [nico]

current discussion: labeling of form fields for credential capture (when the password manager learns creds) and credential presentation (when the pw mgr fills creds in)

00:17:33 [scribe]

q+ tlr

00:17:38 [scribe]

q+ john

00:17:42 [tantek]

and you could use it with <input type="password"> for traditional login (the browser could convert email addresses to mailto: URLs in an <input type="identity-url">

00:17:42 [scribe]

ack dirk

00:17:58 [scribe]

q+ paul

00:18:11 [scribe]

q+ a1

00:18:48 [nico]

"we dont want to assume the browser is in the TCB because it's susceptible to malware"

00:19:00 [tantek]

btw - I prefer <input type="identity-url"> over <input type="identity-uri"> because <input type="url"> already exists in HTML5 (i.e. that bikeshed fight has already been fought - so let's just re-use the existing pattern/decision)

00:19:01 [nico]

(who's the speaker?)

00:19:31 [tantek]

fine, then those sites that don't want to assume the browser can simply not use those <input> types

00:19:36 [scribe]

q+ adams

00:19:55 [nico]

"if you're relying on something that can be easily compromised, that causes more harm than good"

00:20:00 [nico]

(speaker?)

00:20:19 [hober]

<input type=identity-url> falls back to <input type=text> in browsers that don't support it, which is pretty much exactly what you want

00:20:19 [karen]

Dan Schutzer, FSTC/BITS

00:20:37 [tantek]

hober, exactly

00:20:40 [nico]

thanks

00:21:14 [nico]

<something about two factor auth> "to prevent fraud we need end-to-end security"

00:21:41 [scribe]

ack tlr

00:22:02 [nico]

that was Dominique (sp?)

00:22:13 [karen]

Speaker from Bank of America, Dominique Nguyen

00:22:33 [jimklo]

jimklo has joined #idbrowser

00:23:19 [nico]

response: "allowing the browser to get involved in credential presentation, letting the site tell us that we must not do that... we could generate really good passwords for the user, wouldn't that be better?"

00:23:43 [nico]

"you're telling your users to remember memorabe passwords, [implication: that's bad]"

00:24:21 [scribe]

q+ tyler

00:24:22 [nico]

dan: "the concern is about the link in the chain"

00:25:03 [nico]

<missed stuff>

00:25:42 [nico]

"in the browser case they can tell they are using firefox..."

00:25:57 [nico]

dan: "but they can't tell if they're using bank of america"

00:26:27 [nico]

<comment about agency and application mismatch>

00:26:29 [scribe]

ack john

00:27:31 [nico]

john linn: ""we're taking as a premise that the browser is central, so we have to trust it, so it has to be trustworthy, but it's not less vulnerable to attack"

00:28:17 [nico]

dominique: if you can improve the browser, that'd be the first step

00:28:58 [nico]

response: I do want to assume the browser is trusted, working hard to make it trustworthy, but it's a very valid point

00:29:37 [nico]

"it's the simplest possible answer. if I carry a keyfob, that adds value, but there's a large chunk of the market where we can't do that"

00:30:28 [nico]

<comments about designing for unintended consequences>

00:31:09 [scribe]

q+ a2

00:31:09 [nico]

<human brains are full, can't remember enough passwords, it'd be great if they wrote them down, but we told them not to>

00:31:46 [nico]

<comments about generating good passwords for the user>

00:32:17 [nico]

so, I'm not that good a scribe :(

00:32:56 [scribe]

ack paukl

00:32:59 [nico]

harry: if I'd told you that JavaSript would become so universal 10 years ago, you'd have said "impossible!"...

00:33:10 [scribe]

ack tyler

00:33:22 [nico]

harry: so we can do good things that seem impossible now

00:33:59 [dsinger_]

dsinger_ has joined #idbrowser

00:34:02 [nico]

<comment about how easy it seems to steal passwords from the firefox password manager if ff is compromised>

00:34:24 [nico]

<yes, but you're losing your secrets in other ways anyways>

00:34:37 [nico]

<yes, but this could lead to a pandemic>

00:35:02 [scribe]

q+ plh

00:35:04 [nico]

<fair comment, I'm asking whether the banks want us to store user passwords for bank accounts>

00:35:07 [scribe]

ack pal

00:35:10 [scribe]

ack a1

00:35:16 [nico]

sam: as a user I wish you would [let us]

00:35:48 [nico]

<... comments about viability risk>

00:36:54 [nico]

<there are other jurisdictions that don't work the way we're used to, so there are some legal ramifications to consider>

00:37:06 [dsinger_]

S/viability/liability/

00:37:35 [tantek]

um, why are non-lawyers arguing/discussing liability?

00:37:47 [nico]

<does the provider of the browser have liability for losses? one opinion is: it's free, so no, but another is that by providing something you have some responsibility. what the standard is is anybody's guess>

00:38:07 [nico]

tantek: because we have to to some degree?

00:38:09 [tantek]

appeal to meeting chairs: please rule this topic (liability) out of scope for this meeting

00:38:16 [scribe]

tantek, tom smedinghoff is definitely a lawyer :)

00:38:20 [tantek]

oh ok

00:38:23 [tantek]

then the rest of us

00:38:30 [PhilHunt]

q+

00:38:30 [nico]

<we may get class action lawsuits. dunno that it'd come out well for the browser vendors>

00:38:47 [tantek]

nico - we don't have sufficient expertise to have a meaningful discussion - hence request for out-of-scoping the topic

00:38:49 [nico]

<the PR impact of massive compromises would be awful>

00:38:50 [scribe]

ack plh

00:38:56 [scribe]

ack pal

00:38:58 [scribe]

ack paul

00:38:59 [scribe]

ack adams

00:39:33 [nico]

phillip: we don't have an internet security problem, we have a bank security problem (pointing to passwords printed on credit cards :)

00:40:03 [nico]

phillip: separate accounts for spending vs. money mgmt [I missed something]

00:40:32 [nico]

phillip: <missed stuff>

00:40:39 [maryhodder]

phillip said: login is different than the transaction PW

00:40:47 [scribe]

q+ dirk

00:40:53 [scribe]

q+ tom

00:40:55 [nico]

ok, so restated

00:40:58 [scribe]

q+ a3

00:41:14 [scribe]

ack a2

00:42:02 [nico]

brian: you mentioned intermediate steps... I think one might be to have fewer passwords, and reduce the number of servers that they must be shared with, also password verifiers, and this could be done without having to solve the federated problem

00:43:06 [nico]

<one immediate reaction is that there's a lot of points in the design space, well, if we say that too many passwords is the immediate problem, then there's some things we could do... e.g., consolidation on federated auth

00:43:22 [scribe]

ack PhilHunt

00:43:25 [nico]

<...>

00:43:52 [nico]

<a lot of emphasis on passwords; but that's a moving target; banks are moving to multi-factor>

00:44:44 [nico]

sam: I'll be talking tomorrow, but I think that the password manager could be the granddaddy for a good ID manager; let's not throw out something that's useful today that we could make into something great tomorrow>

00:45:04 [josephboyle]

http://www.w3.org/2011/05/25-idbrowser-minutes.html still showing diagnostics not content

00:45:17 [nico]

<comments about distinction between initial and derivative credentials> (did I understand correctly>)

00:45:22 [hallambaker]

hallambaker has joined #idbrowser

00:45:49 [nico]

<we work with Peter Watson and others up in Columbia on componentized stuff that is pretty attractive>

00:46:31 [scribe]

ack dirk

00:46:41 [nico]

<stuff we're not leveraging here in the user/browser/service interaction>

00:46:56 [nico]

<credentials nowadays are mostly compromised on the servers!>

00:47:02 [scribe]

q+ nico

00:47:03 [tantek]

finally! real-world examples of security problems instead of handwaving!

00:47:11 [tantek]

password compromises come from servers, not browsers

00:47:14 [tantek]

e.g. Gawker, Sony

00:47:17 [nico]

heh

00:47:30 [scribe]

ack tom

00:47:36 [nico]

<doesn't France require cleartext passwords be available on demand?

00:47:47 [PHB]

PHB has joined #idbrowser

00:48:10 [scribe]

I believe Tom crafted the legal work behind EV certs, so we have one actual lawyer in the audience.

00:48:43 [nico]

<there's a policy overlay here too; we as society say to the banks "you guys set this up, you're responsible for breaches", so when consumers' accounts are compromised, the users have minimal liability, so this has some impact...

00:49:01 [nico]

<when banks move to two factor auth, it's because they are forced to...>

00:49:41 [scribe]

ack a3

00:49:54 [nico]

<"snopes facts" -- do we have data on hackings?>

00:51:07 [nico]

<maybe we don't see cred theft because the bad guys can use them as it is anyways since they hvave the malware for it>

00:51:27 [nico]

<comment about more labeling of relative value f credentials>

00:51:41 [scribe]

q+ dan

00:52:03 [scribe]

ack nico

00:52:06 [nico]

<msft publishes some such data>

00:53:25 [scribe]

q+ bob

00:53:27 [scribe]

q+ a1

00:53:57 [nico]

I said that server issues are mostly out of scope here... and I asked if Craig had intended to distinguish between initial and non-initial credentials (think tickets)

00:54:10 [nico]

and I said that I like that distinction

00:54:36 [nico]

craig: <missed it>

00:55:38 [nico]

dan: at iiw there was a comment made by... eric saxe? that he was more worried about people's passwords being terrible than about phishing

00:55:58 [nico]

so, fixing phishing but keeping passwords may be a problem

00:56:06 [scribe]

s/missed it/using 2-factor authentication we could use trusted location and devices

00:56:11 [scribe]

s/saxe?/sachs

00:56:27 [scribe]

q+ a4

00:56:32 [scribe]

ack dan

00:56:33 [nico]

<have we thought about doing client assessment stuff?>

00:56:43 [scribe]

ack bob

00:57:03 [nico]

bob, sam: well, there's the lying endpoint problem

00:57:12 [hartmans]

hartmans has joined #idbrowser

00:57:31 [nico]

bob: the servers could make statements about what kinds of practices they want from the clients, that could be useful

00:57:59 [nico]

<service providers will typically ignore claims by clients>

00:58:18 [scribe]

ack a1

00:59:02 [scribe]

ack a4

00:59:11 [nico]

<stolen temporary credentials can still be used to do a lot of harm>,

00:59:29 [karen]

a1 speaker is David Chadwick, University of Kent, UK

00:59:38 [nico]

<comments about devices and doing NEA that way>

00:59:39 [fjh]

fjh has joined #idbrowser

00:59:49 [nico]

(TPMs??)

01:00:02 [scribe]

q+ nico

01:00:05 [scribe]

q+ plh

01:00:09 [nico]

<what could a device say to increase trust>

01:00:18 [nico]

<well, the device could have a public key...>

01:00:58 [nico]

so, yes, TPMs

01:01:16 [scribe]

q+ brian

01:01:16 [karen]

Speaker was Mark Watson, Netflix

01:01:17 [nico]

<privacy considerations>

01:01:53 [nico]

harry: surprising consensus about password managers

01:02:25 [scribe]

ack nico

01:02:27 [scribe]

ack plh

01:03:23 [nico]

<at Mozilla we spend a lot of effort on trying to make tracking harder>

01:03:41 [nico]

(I think that was a comment in relation to the privacy considerations regarding TPMs)

01:03:44 [scribe]

q+ tlr

01:03:57 [scribe]

q+ dan

01:04:00 [nico]

<well, one need not prove identity, just trustworthiness>

01:04:11 [scribe]

q+ sam

01:04:14 [nico]

<so prove this is a Samsung TV, not which one>

01:04:52 [scribe]

ack brian

01:04:59 [jimklo_]

jimklo_ has joined #idbrowser

01:05:04 [nico]

sam: don't see how to do that without violating privacy; also, go to an underround electronics sop sometime, see the counterfeits

01:05:24 [scribe]

ack dan

01:05:24 [nico]

<comment about aliasing>

01:05:25 [scribe]

ack sam

01:05:43 [tlr]

q-

01:05:44 [nico]

dan: <missed it, sorry>

01:06:10 [nico]

<there's a difference when you sign up and pay for something>

01:06:19 [scribe]

s/missed it, sorry/fingerprinting does have legitimate uses sometimes

01:06:28 [nico]

craig: it's more complicated for users to deal with hardware IDs

01:06:38 [nico]

scribe: thanks

01:06:53 [nico]

I'm missing this too

01:07:06 [PHB]

Can get to a pretty solid proof that the browser visiting the site NOW is the same as the browser that visited a month ago

01:08:19 [nico]

bob: basically, it's hard to manage all these IDs, and it's a big DB, and maybe you don't manage it well, and you could lose your users stuff, and so device IDs is hard to deploy

01:09:02 [nico]

harry: asking about crypto APIs

01:09:12 [nico]

so, a hum

01:10:10 [tlr]

andersR: access to credential stores is critical element

01:10:27 [nico1]

nico1 has joined #idbrowser

01:10:38 [tlr]

phb: frameworks are a way to avoid making choices. standards are about making choices.

01:10:48 [tlr]

crocker: discuss more tomorrow

01:11:01 [tlr]

??: framework gives choice of what mechanism to use

01:11:09 [karen]

?? is Nico

01:11:16 [tlr]

s/??/Nico/

01:11:39 [nico1]

y

01:11:53 [nico1]

harry: so more on this tomorrow

01:12:01 [tlr]

tlr: sounds like we need to flesh out scope of api discussion tomorrow

01:12:04 [nico1]

harry: attaching ID to session states (?)

01:12:08 [nico1]

incognito mode

01:12:18 [nico1]

is this something that's of interest to people

01:12:22 [tlr]

identity attached to session state / login/logout functionality

01:12:36 [nico1]

sam: useful, but not necessarily in scope

01:12:52 [nico1]

<let's define what we mean by incognito mode>

01:13:11 [nico1]

harry: I just remember ppl mentioning multiple personane

01:13:14 [nico1]

...

01:13:42 [nico1]

comments about lack of competitiveness regarding incognito mode

01:15:09 [nico1]

dan: nothing prevents users from using pw managers

01:15:30 [nico1]

reply: well, stock browsers don't let you

01:15:35 [nico1]

for bank creds

01:15:49 [nico1]

<use of password managers is growing>

01:16:25 [nico1]

<users don't understand why pw mgrs do or do not fill things in -- whn the pw mgr doesn't then the user thinks it's broken>

01:16:54 [nico1]

harry: asking about consensus regarding the annotations concept

01:17:44 [nico1]

<analogy about how an RFC exists that specifies of annotations, but that no one knew about it!>

01:18:33 [nico1]

<it should be harmless to define these tags>

01:18:45 [nico1]

<unless we start we won't get there>

01:19:07 [nico1]

<it's important to also annotate the cookies>

01:19:33 [nico1]

(basically making the cookie a derivative credentials)

01:19:50 [nico1]

phl: <concurs>

01:20:07 [nico1]

hannes: <also concurs>

01:20:28 [nico1]

bob: that's of a piece with my comment about labeling session IDs

01:20:29 [tantek]

what was the specific RFC for suggested labels?

01:20:33 [tantek]

does anyone know it?

01:20:44 [tantek]

or could the person who spoke with Hixie please dig it up from their email etc. and post it?

01:20:55 [nico1]

tantek: it was said to be 3127

01:21:18 [nico1]

I'm falling behind on scribing

01:21:33 [tantek]

Hixie's argument is sound. Re-inventing a previously failed standard is not a rational path unless you can point out key reasons for failure that your re-invention is specifically addressing.

01:21:38 [nico1]

harry: agenda for tomorrow

01:21:55 [tantek]

I thought "3127" was said like an example of an RFC #, not the actual #.

01:22:08 [nico1]

tantek: I thought so too

01:22:17 [nico1]

root around for it?

01:22:30 [nico1]

harry: we might want to re-bake the agenda

01:23:18 [tantek]

who was the Google person that claimed he spoke with "Ian Hixie" [sic]

01:23:20 [tantek]

?

01:23:27 [tantek]

perhaps we can ask him for the specific RFC #

01:23:33 [tantek]

I'd like to track this down

01:23:54 [yoiwa]

RFC 3127 is "Authentication, Authorization, and Accounting: Protocol Evaluation" (Informational)

01:34:49 [karen]

rrsagent, make minutes

01:34:49 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html karen

01:36:39 [nico1]

nico1 has left #idbrowser

01:38:10 [karen]

Harry: we don't have complete agreement

01:38:23 [karen]

...but have more proposals for scope; would like to have that list...10 proposals

01:38:42 [karen]

.Speaker: I did not get the sense...third party; token use

01:38:50 [karen]

Harry: It was brought up several times; we can revisit that

01:38:59 [karen]

...discussion went away from that; like mobile discussion

01:39:08 [karen]

TLR: We have room for that in the Beyond the Browser session

01:39:17 [karen]

Speaker: talking about that as opposed to tokens

01:39:22 [karen]

TLR: Use case will bring it up

01:39:31 [karen]

Bob: Bring up browser support for IP discovery

01:39:36 [karen]

...hoping that may be in

01:39:40 [karen]

...and other concrete suggestions

01:39:50 [karen]

Harry: I think it rather naturally comes into it today

01:39:54 [karen]

...Dinner at Shivas

01:40:04 [karen]

800 California Street, #100

01:40:17 [karen]

Buffet dinner starts at 7:00pm

01:40:25 [karen]

Trent: Please pick up your trash

01:40:33 [karen]

Meeting adjourned

01:40:37 [karen]

rrsagent, make minutes

01:40:37 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html karen

01:40:56 [yoiwa]

yoiwa has left #idbrowser

01:41:45 [karen]

karen has left #idbrowser

01:47:36 [AndroUser2]

AndroUser2 has joined #idbrowser

03:20:04 [Zakim]

Zakim has left #idbrowser

03:41:01 [hartmans]

hartmans has joined #idbrowser

04:02:36 [lowenthal]

lowenthal has joined #idbrowser

04:27:07 [Vladimir]

Vladimir has joined #idbrowser

04:41:09 [bblfish]

bblfish has joined #idbrowser

05:03:45 [hhalpin]

hhalpin has joined #idbrowser

05:21:46 [mixedpuppy]

mixedpuppy has joined #idbrowser

16:17:14 [RRSAgent]

RRSAgent has joined #idbrowser

16:17:14 [RRSAgent]

logging to http://www.w3.org/2011/05/25-idbrowser-irc

16:17:29 [karen]

...is problem about too many passwords; or not at all; too weak

16:17:33 [PHB]

PHB has joined #idbrowser

16:17:35 [karen]

...everyone will have different POVs

16:17:44 [karen]

...no stopping; how do we know when online identity is solved

16:17:49 [karen]

,..it's not a check-mate end

16:18:02 [karen]

...related to that, solutions are not true or false; something is better than another

16:18:10 [karen]

...cannot have a proof for sovling online identity

16:18:25 [tyler]

tyler has joined #idbrowser

16:18:25 [karen]

...maybe say something about crypto

16:18:25 [karen]

...but the overall thing is fuzzier

16:18:26 [tlr]

http://en.wikipedia.org/wiki/Wicked_problem

16:18:30 [karen]

...Next problem is that there is not an immediate test of what will happen

16:18:38 [karen]

...everything has unfortunate side effects

16:18:44 [karen]

...If we roll out @@auth

16:18:52 [karen]

...could push into malware and have other repercussions

16:18:58 [tyler]

Anyone got a link to the Workshop wiki handy?

16:19:00 [karen]

...Cannot look into future or rewind the past

16:19:07 [karen]

...Everything happens in the real world as we speak

16:19:26 [karen]

...If you screw up privacy like Google did, it's challengin

16:19:42 [karen]

...You get damaged by this if you screw up; you lose credibility

16:19:50 [karen]

...It's not like science where you can celebrate failure

16:19:54 [karen]

...In real life, it's bad

16:20:00 [karen]

...If passport failed for Microsoft

16:20:17 [karen]

...some people wrote it off, so they were blackballed

16:20:24 [karen]

...You cannot sit down and choose six different things

16:20:33 [karen]

...We have seen a dozen things already in this Workshop

16:20:50 [karen]

...In science you want to say you have a set of techniques, such as building a bridge

16:20:56 [karen]

...but this space is essentially different

16:21:07 [karen]

...Identity on the Web is not like identity in the real world; no real person's face

16:21:16 [karen]

...Not like identity in Internet with one admin domain

16:21:22 [karen]

...what worked here won't work there

16:21:34 [karen]

...reasons for failure are over-determined

16:21:49 [hodges]

hodges has joined #idbrowser

16:21:51 [karen]

...Did infocard fail due to user experience; too complex a mental model; don't know

16:21:54 [karen]

...cannot rewind the past

16:21:58 [karen]

...All I wanted to do

16:22:03 [karen]

...really interesting framework

16:22:08 [karen]

...I'll put up references

16:22:23 [karen]

...Some white papers you can read

16:22:32 [fjh]

fjh has joined #idbrowser

16:22:37 [karen]

...They have some frameworks for how to address problems to build shared understanding

16:22:44 [karen]

...And most important, capture that somewhere

16:22:51 [karen]

...So next time you can pick up from where you left off

16:22:56 [karen]

...and not recreate all the past conversations

16:23:15 [karen]

...So for today, think about what I said here; we all have different stakes, viewpoints, backgrounds

16:23:25 [karen]

...Be careful when you say the problem is not x it's y

16:23:32 [karen]

...their assumptions and values are different

16:23:36 [karen]

...Other obvious anecdote

16:23:43 [karen]

...Think about the rules for passports

16:23:51 [karen]

s/passports/passwords

16:23:55 [karen]

...Think about how you pick it

16:24:10 [karen]

...All these security experts thought different approaches would work to select them

16:24:19 [karen]

...No consensus, but all defensible positions

16:24:25 [karen]

...So important to have this context

16:24:36 [karen]

Q: Any data to back up assertions

16:24:41 [karen]

A: no

16:24:41 [tantek]

tantek has joined #idbrowser

16:24:56 [karen]

Harry: let's hold questions until end of session

16:25:04 [tantek]

that was me that asked "Did any of them have data to support their assertions?"

16:25:10 [tantek]

answer was "no"

16:25:21 [JeffH]

so there will be some way to recover these irc logs ?

16:25:33 [karen]

Next Speaker: Philipp Hollam Baker, Comodo

16:25:42 [karen]

Topic: Simulation & Design for Deployment

16:25:47 [tantek]

(in reference to the room full of Google security experts all recommending different ways to make "good" (strong) passwords)

16:26:11 [karen]

Problem is how do you get that problem deployed; Internet has 20 billion users

16:26:29 [tantek]

I think that was 2 billion

16:26:30 [karen]

...how I deal with this problem is I design simulations

16:26:42 [karen]

...and identify which audiences need to address protocol

16:26:52 [karen]

...and I simulate; use stuff from control system world

16:26:59 [karen]

...can use software or even Excel

16:27:04 [karen]

...Do need to test assumptions

16:27:09 [karen]

...If you think viral marketing will take off

16:27:19 [karen]

...if you are talking viral or network effect, you are fooling yourself

16:27:25 [karen]

...Chicken and egg problem

16:27:32 [karen]

...getting to critical mass is really hard

16:27:40 [karen]

...Simply having Microsoft say it won't work

16:27:46 [karen]

...some things will kill your proposal

16:27:53 [karen]

...One is deployment deadlock

16:28:00 [karen]

...If servers do this or that

16:28:08 [wbaker]

wbaker has joined #idbrowser

16:28:12 [karen]

...stopped working when Web had a million users

16:28:13 [bblfish_]

bblfish_ has joined #idbrowser

16:28:22 [karen]

...Digest authentication was proposed seven days after basic

16:28:32 [karen]

...Basic was deployed and enmeshed in Web six days after it was proposed

16:28:44 [karen]

...I proposed digest on next day and it took five years to get into browsers

16:28:46 [fjh_]

fjh_ has joined #idbrowser

16:28:51 [karen]

...Once something works well, it's hard to replace

16:29:07 [karen]

...Getting to web sites

16:29:17 [yoiwa]

yoiwa has joined #idbrowser

16:29:18 [karen]

...I won't use your identity scheme if it does save time

16:29:31 [karen]

...Users are aware of razor and blades model

16:29:47 [karen]

...Unlike other workshops, I am seeing technology proposals not business proposals

16:30:03 [karen]

...First proposal is to put the account manager in the cloud

16:30:14 [karen]

...we can do it securely and user never needs to know what is going on

16:30:22 [karen]

...can get access; can support legacy browsers

16:30:30 [karen]

...Why start here? User can do on their onw

16:30:36 [karen]

...I know companies looking at this

16:30:44 [karen]

...they don't need participation of any other party

16:30:52 [karen]

...I'm doing this to save my time, not establish a bus model

16:30:55 [karen]

...Could do in two ways

16:31:07 [karen]

...just solve this problem, make easy to store passwords in the cloud

16:31:20 [karen]

...But then write protocols to go slightly more sophisticated

16:31:32 [karen]

...allow a secure authentication mechanism

16:31:42 [karen]

...not choose too many or invent something new unless I have to

16:31:50 [steve_schultze]

steve_schultze has joined #idbrowser

16:31:59 [karen]

...if I can coopt OpenID or SAML people I can do it faster

16:32:07 [karen]

...phase two builds out on phase one

16:32:17 [karen]

...Finally, this was originally proposed as phase three

16:32:23 [karen]

...putting user names and passwords in the cloud

16:32:34 [karen]

...don't put pw into password manager

16:32:42 [karen]

...Who here does not have a smart phone?

16:32:48 [karen]

[one hand]

16:33:01 [karen]

Philipp: Ok, so you all know you can get AUTH

16:33:14 [karen]

...congrats, you have now simulated a 1960s technology on a smart phone

16:33:23 [karen]

...this thing has a display, keyboard, voice input

16:33:26 [karen]

...could we do more?

16:33:35 [karen]

...I'm buying my phase kit off eBay

16:33:48 [karen]

...so instead of typing passcode, would be nice to have been asked

16:33:51 [karen]

...I mentioned voice

16:33:55 [karen]

...for applications that demand it

16:34:09 [karen]

...Take a picture of person taking purchase; put in a pin number

16:34:18 [karen]

...we could have voice recognition or voice recog biometrics

16:34:22 [karen]

...We have a really powerful toool

16:34:29 [karen]

...This could start to deploy now in the enterprise

16:34:41 [karen]

...i looked up $20 per year for one-time password tokens

16:34:55 [karen]

...This requires no software; can be done quickly and enterprises can adopt unilaterally

16:34:57 [karen]

...thank you

16:35:49 [karen]

Harry: up next is Sam Hartman from Painless Security

16:36:03 [karen]

...I would like to talk about the value of the browser in supporitng identity management

16:36:09 [bkihara]

bkihara has joined #idbrowser

16:36:13 [karen]

...and in supporting the kinds of things that Phil

16:36:21 [karen]

...making things easier to deploy so we get innovation

16:36:23 [karen]

...to start off

16:36:33 [karen]

...One of things to realize is things platform can do

16:36:39 [karen]

...you cannot write Java Script

16:36:46 [karen]

...platform mediates cross application and site information

16:36:54 [karen]

...yesterday Bob talked about the identity selection problem

16:37:07 [karen]

...When he was talking he said it is hard for service providers to drive the selection problem

16:37:20 [karen]

...The platform is in postion to know what the identities are that are broader than one site

16:37:29 [karen]

...site is in position to reasonably know about the identities

16:37:42 [karen]

...So together you can have the platform; a good understanding of what the identities are

16:37:57 [karen]

...better position to ask user who they want to be today versus a site asking it the possibilities

16:38:14 [karen]

...Another thing the platform can be in a position to do

16:38:35 [karen]

...some sites can manage iphones to traditional desktops

16:38:44 [karen]

...can be in enterprise or individuals

16:38:45 [AndroUser]

AndroUser has joined #idbrowser

16:38:49 [jimklo]

jimklo has joined #idbrowser

16:38:51 [dveditz]

dveditz has joined #idbrowser

16:38:53 [karen]

...platform can enforce policy that is broader

16:39:03 [karen]

...Also platform can cross identity beyond justthe web browser

16:39:09 [karen]

...ID not just in some app

16:39:13 [karen]

...used in some web resources

16:39:17 [karen]

...you need the platform's involvement

16:39:23 [karen]

...as we discussed yesterday

16:39:38 [karen]

...there are cases where the browser is used less, particularly the mobile environment

16:39:44 [karen]

...Cannot just treat as a web id problem

16:39:48 [karen]

...finally something the platform can do

16:39:52 [karen]

...that can enable security

16:39:59 [karen]

...Something that one of first presentations talked about

16:40:02 [karen]

...channel bindings

16:40:10 [karen]

...is about tying two security relationships together

16:40:21 [karen]

...Can allow you to have an association with some web site

16:40:30 [karen]

...and can confirm even the certificate has changed

16:40:36 [steve_schultze]

steve_schultze has joined #idbrowser

16:40:39 [karen]

...Also valuable in device authentification

16:40:47 [karen]

...if user has inserted himself into device

16:40:53 [karen]

...could break some use cases

16:41:13 [karen]

...the platform could tie these sorts of identification together

16:41:20 [karen]

...Would be nice to pick one like OpenID

16:41:24 [karen]

...but we cannot just pick one

16:41:26 [Vladimir_]

Vladimir_ has joined #idbrowser

16:41:28 [jimklo_]

jimklo_ has joined #idbrowser

16:41:31 [karen]

...Different organizations...

16:41:43 [karen]

...If you tell me I have to change from one thing to something else

16:41:48 [karen]

...why is that in my best interest?

16:41:52 [fjh_]

fjh_ has joined #idbrowser

16:41:57 [karen]

....Lots of properties to these identity management systems

16:42:06 [karen]

...attempt to consume lots of identities

16:42:21 [karen]

...Some aspects are part of system and a critical part of using

16:42:21 [karen]

it

16:42:27 [karen]

...like Kerberos using it

16:42:34 [bkihara_]

bkihara_ has joined #idbrowser

16:42:37 [karen]

...things based on URIs versus naming things based on other approaches

16:42:48 [karen]

...and sometimes those differences are important to people

16:42:53 [karen]

...if we don't have a way to dispose

16:43:06 [karen]

...and force all identity management to be the same, we will defeat choice of using them

16:43:17 [karen]

...ont he other hand, important

16:43:24 [jtrentadams]

jtrentadams has joined #idbrowser

16:43:25 [karen]

...not to have to know ...

16:43:37 [karen]

...permit only when you need to take advantage of the special properties

16:43:48 [karen]

..I come from identity management background outside of the Web

16:43:52 [karen]

...a lot of things going on there

16:43:57 [bkihara_]

bkihara_ has joined #idbrowser

16:44:10 [karen]

...I think that we have a real opportunity for a convergence of these approaches with what is going on the Web

16:44:14 [dpranke]

dpranke has joined #idbrowser

16:44:21 [karen]

...the best identity management story we have seen is cases where there is a real decoupling from the application

16:44:41 [karen]

...plug in new security mechanism, or deployment and mechanism will work within new environment without being aware of it

16:44:51 [karen]

...Major desktop systems have this such as Microsoft

16:45:00 [karen]

...Take a look of hosted services on Windows Live

16:45:08 [karen]

...where they inveneted a new service

16:45:22 [karen]

...They were not previously aware

16:45:34 [karen]

...At IETF we are working on things

16:45:44 [karen]

...A single way of looking at Open IDE, OAUTH, SAML, Kerberos and public key

16:45:59 [karen]

...the application won't get any of those the same, but can delve into detail

16:46:08 [karen]

...and take advantage of specifics of the mechanism if necessary

16:46:23 [karen]

...also at IETF, project Moonshot is looking at how to create an identity management mechanism

16:46:28 [karen]

...uses SAML to look at things

16:46:38 [karen]

...intended to work well in a federated environment

16:46:47 [karen]

...address privacy issues we are talking about

16:47:07 [karen]

...address mechanisms that are highly integrated into platform

16:47:22 [karen]

...Basically, what I am proposing to look at

16:47:33 [karen]

...is an approach where the application and platform can both contribute

16:47:44 [karen]

...application can take advantage of identity coming from that

16:47:57 [karen]

...and can provide set of mechanisms; can inject an identity into the system

16:48:03 [karen]

...not about solving users typing id into system

16:48:10 [karen]

...about enabling credentials in future

16:48:14 [karen]

...that are not passwords

16:48:17 [karen]

...Final recommendation

16:48:24 [karen]

...more detail from previous slide

16:48:28 [karen]

...Ok

16:48:45 [karen]

Harry: We are going to begin discussion on Platform issue for ten minutes

16:48:55 [karen]

...then continue with Device discussion and then take a break

16:49:19 [karen]

CarlH: Identity really is a wicked problem

16:49:19 [benadida]

q+

16:49:28 [karen]

...I think it will require inconsistency robustness

16:49:32 [Zakim]

Zakim has joined #idbrowser

16:49:34 [benadida]

q+

16:49:34 [karen]

...cannot be algorithmic solution

16:49:41 [karen]

...like credit cards, do you pass this charge or not?

16:49:49 [karen]

...evidence for or against and make the decision

16:49:59 [karen]

...if it is a wicked problem, this is where you need to go

16:50:02 [karen]

...may be onlly thing to do the job

16:50:07 [karen]

? Comment on ???

16:50:19 [karen]

...Smartphone, you don't use browser, just native apps

16:50:31 [karen]

...does not mean browser should not handle identity

16:50:34 [karen]

...there is trust

16:50:42 [karen]

...could be done relatively easily

16:50:46 [karen]

...like OpenID a mechanism

16:50:58 [karen]

...think of bringing app into smartphone

16:51:08 [karen]

...you redirect to identity provider and redirects using a custom URI

16:51:14 [karen]

...what is missing is the first leg

16:51:21 [karen]

...what it means for first app to redirect

16:51:26 [karen]

...when you have direct access to begin with

16:51:35 [karen]

...maybe that is something the browser providers should think about

16:51:39 [fjh]

what makes a browser "trusted"?

16:51:42 [karen]

Sam: I agree that use pattern could be supported

16:51:51 [karen]

...i want to see a way to invoke that pattern

16:52:08 [zolli]

zolli has joined #idbrowser

16:52:13 [karen]

JeffH: I just wanted to support notion of identity spams far outside this thing called the browser

16:52:25 [karen]

...many of apps on smartphones are browsers...mobile code

16:52:34 [karen]

...that environment is getting married to the platform

16:52:41 [karen]

...agree we need to think about this more holistically

16:52:48 [karen]

Q? you may not trust that

16:52:53 [karen]

JeffH: that is a big problme

16:52:58 [karen]

Nico: I want to echo that there are

16:53:05 [karen]

...browser apps and HTTP applications

16:53:13 [karen]

...dapper and that sort of thing

16:53:19 [karen]

...Browser apps use HTTP

16:53:31 [karen]

JeffH: there are protocols in wide use beyond HTTP

16:53:48 [karen]

Q: another approach is to use standardized mechanisms out to the platform

16:53:52 [karen]

...such as what Microsoft has done

16:53:56 [karen]

...with identification

16:54:01 [karen]

...beyond multifactor things

16:54:13 [karen]

...browser can react in more robust way; and can you channel that back

16:54:20 [karen]

...browser can still be the locus

16:54:36 [karen]

Sam: that's great if I trust the browser or if I have an identity for which it's the locus

16:54:42 [karen]

...but in enterprise that does not make sense

16:54:51 [karen]

...If I am an unintended app, the browser is wrong place for it

16:55:02 [karen]

...as a human, the browser is wrong choice for my ID locus

16:55:12 [karen]

...you have described an important use pattern

16:55:22 [karen]

...but many different approches, as Dirk described

16:55:28 [karen]

Ben Adida: one point Phil made

16:55:41 [karen]

...it's not just crypto

16:55:44 [karen]

...hate to bring up SONY; when you concetrate a lot of data into the cloud.

16:55:48 [karen]

...can be more complicated

16:55:55 [karen]

PhilHB:decide what you can accept

16:56:04 [karen]

...such as accepting, storing credit card data

16:56:09 [karen]

...and whether to store in unencrypted

16:56:24 [karen]

...I just had my credit card suspended from Michael's retailer because it was hacked

16:56:33 [karen]

Harry: we will close the queue now

16:56:47 [karen]

Speaker is Direck Balfanz, Google

16:56:47 [bkihara_]

bkihara_ has joined #idbrowser

16:56:54 [karen]

Dirk: I want to do a demo

16:57:06 [karen]

...so thanks, Sam, a lot of what you said will be a great introduction

16:57:12 [karen]

...to what I will talk about on Android

16:57:20 [karen]

...how we are using it on installed apps as well as browser

16:57:25 [karen]

...and talk about how to do this more generally

16:57:35 [karen]

...So what does the account manager on Android do?

16:57:49 [karen]

...so the way it works is you write plug-ins called authenticators

16:58:02 [karen]

...app users an API to say I want a ? complete to talk to some service provider

16:58:15 [karen]

...which of these plug-ins and what account installed on device this token should be fo

16:58:23 [karen]

...plug-in does magic and returns to server

16:58:29 [karen]

...so plug-ins store user credentials

16:58:32 [karen]

...let me show you

16:58:36 [karen]

...here is an Android device

16:58:45 [karen]

...and so the account manager here as a bit of a UI

16:58:56 [karen]

...two accounts currently installed on this device and I can add more

16:58:59 [karen]

...add a Google account

16:59:05 [karen]

...I can say take me to a browser

16:59:15 [karen]

...let me use a more complicated login procedure at Google

16:59:20 [steve_schultze]

steve_schultze has joined #idbrowser

16:59:37 [karen]

...this in an account that has OpenID turned on, so I get redirected to Yahoo!

16:59:54 [karen]

...You could imagine other things like two-factor id, or log-in challenges that complicate things

17:00:38 [karen]

[checking network]

17:00:42 [karen]

...Let's try again

17:00:55 [karen]

rrsagent, make minutes

17:00:55 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html karen

17:01:05 [JeffH]

@karen -- u doing valiant yeoman's work there :)

17:01:07 [karen]

...I can readwrite to Yahoo

17:01:33 [karen]

...So what you will hopefully see, is an installed app AUTH flow

17:01:45 [karen]

...could have been something more complicated like a two-factor authentification

17:01:54 [karen]

...device gets an AUTH token for this account

17:01:59 [karen]

...so now a third

17:02:08 [karen]

...installing on account manager and seeing what is there

17:02:17 [karen]

...store account credentials, don't have to see it again

17:02:24 [karen]

...type into phone and don't have to do it again

17:02:33 [karen]

...uses an API for the accoutn manager which remembers your passwrod

17:02:36 [karen]

...takes care of rest

17:02:44 [karen]

...no need for app to take care of ?

17:02:52 [karen]

...one of APIs it provides

17:02:58 [karen]

...apps can show you this list of accounts

17:03:07 [karen]

...installed lists, some confusions

17:03:11 [karen]

...link with same accoutns

17:03:17 [karen]

...So what an app typically does

17:03:25 [karen]

...it calls the account manager to ask what is installed

17:03:28 [karen]

...then you pick account

17:03:39 [karen]

...after you choose, use the acc't manager and talks to server side

17:03:42 [karen]

...What we did in Honecomb

17:03:49 [karen]

...we added acc't manager to device

17:03:56 [karen]

...here is browser, I am not logged in yet

17:04:08 [karen]

...I want to log into my Picasa Web account

17:04:14 [karen]

...so now at Google log-in page

17:04:22 [karen]

...the browser slid in that butter bar

17:04:28 [karen]

...use that to log in

17:04:38 [karen]

...now logged into my Picasa account

17:04:48 [karen]

...you notice what happened is the log-in page was still there

17:04:51 [karen]

...I could log in manually

17:04:55 [karen]

,..but it offered me the choice

17:05:04 [karen]

...Also works with relying parties

17:05:33 [karen]

...they way this works

17:05:47 [karen]

...is that the server sends a header that says I support logins with google account

17:06:01 [karen]

...openID relying party can also use header

17:06:01 [karen]

...using my account manager

17:06:07 [karen]

...get taken to OpenID approval page on Google

17:06:17 [karen]

...being a relying party, the site could have asked for my id, photo

17:06:26 [karen]

...my address book; so appropriate to show an approval page

17:06:34 [karen]

...shows OpenID back to the relying party

17:06:37 [karen]

...using the account manager

17:06:45 [karen]

...two more slides

17:07:01 [karen]

...plug-ins run their own proprietary protocols

17:07:18 [karen]

...one acc't manager you don't have to write prop. protocols, but could do in a standardized way

17:07:24 [karen]

...uses OAuth to install acccounts

17:07:36 [karen]

...one, standardize ways to get credentials into account manager

17:07:54 [karen]

...second thing we need is a standardized way to use that credential, that OAUTh token

17:08:02 [karen]

...to access something, it's downscoping

17:08:05 [karen]

...go to service provider

17:08:10 [karen]

...to hand to the app

17:08:15 [karen]

...third thing I demonstrated

17:08:26 [karen]

...one of tokens is not standard OAuth is URL

17:08:30 [karen]

..and it logs in the user

17:08:35 [karen]

...one-time use

17:08:42 [karen]

...that magic token makes the user get logged in

17:08:50 [karen]

...hit and get back in return a URL

17:08:54 [karen]

...will log in the user

17:09:00 [karen]

...Google has such a URL

17:09:09 [karen]

...other have them, too, so we could standardize on those

17:09:12 [karen]

...no crypto

17:09:24 [karen]

...not standardize how I authenticate to my ID

17:09:32 [karen]

...browser used standard mark-up

17:09:40 [karen]

...just need standardized way for OAuth token

17:10:08 [karen]

...Once I hit that login URL, I can hit it @@

17:10:20 [karen]

...Yesterday we talked about special cookies, I don't think we need those

17:10:34 [karen]

Harry: I like the "do need to standardize and don't need to" list

17:10:42 [karen]

Sam: you don't need to standardize X for your use case

17:10:49 [karen]

...great to innumerate for each use case

17:11:06 [karen]

...but annoying when you say we don't need to standardize at all, because there are more than one use case

17:11:09 [karen]

Harry: goog point

17:11:12 [karen]

s/goog/good

17:11:26 [karen]

BenA: for that web login URL, do envision some special header

17:11:39 [karen]

...so it's coming from more than redirecting? Coming from outside browser?

17:11:47 [karen]

Dirk: If any random web site

17:12:07 [karen]

...saying I support Google logins, and if not relying party, browser will redirect to Google

17:12:11 [karen]

...and I won't see it

17:12:15 [karen]

BenA: I'll take it offline

17:12:21 [karen]

Q: when Google ? to Yahoo

17:12:25 [karen]

...is Google aware of it?

17:12:37 [karen]

DirK: no, fires off an OAuth flow

17:12:42 [karen]

...I need to log in a user

17:12:51 [karen]

...if OpenID, I need to redirect to Yahoo

17:13:23 [karen]

Harry: closed queue, now prsenting is Mark Watson, Netflix

17:13:42 [karen]

Mark Watson: also joining me is Mitch Zollinger, the real security expert

17:13:49 [karen]

...Provider a user perspective today

17:14:05 [karen]

...When it comes to device authentification, some things not possible

17:14:41 [karen]

... if you define a browser as an id environment, and we (netflix) ship browsers to all sorts of devices

17:14:46 [karen]

... you just don't see the chrome

17:14:56 [karen]

... what does secure actually mean

17:15:07 [karen]

... our service and a bunch of others rely on guarantees of device behavior

17:15:11 [karen]

... this is not a normal part of the web

17:15:21 [karen]

... this makes sure we install a reputable browser

17:15:33 [karen]

...examples are HD content

17:15:43 [karen]

...not just our requirement of our service

17:15:49 [karen]

...Other areas are financial services data

17:15:57 [karen]

...that is out of scope of right now

17:16:07 [karen]

...Could imagine other examples such as electronic medical records

17:16:14 [karen]

...haven't thought a lot, but there are others

17:16:26 [karen]

...how do we determine if device has properties to get the proper content

17:16:36 [karen]

...We have restrictions on the number of devices per account

17:16:42 [karen]

...that is a business decision we took

17:17:05 [karen]

...What do we mean by device authentification, staying at requirements level

17:17:05 [lowenthal]

lowenthal has joined #idbrowser

17:17:16 [karen]

...One, we need to id the type of device accessing the service

17:17:30 [karen]

...we don't care if YouTube sees different identifiers for that device

17:17:43 [karen]

...we use it to make authorization decisions and to restrict access

17:17:53 [karen]

...we need to tell what properties the device has

17:18:12 [karen]

...may come from some software, which is weaker and does not provide guarantees

17:18:23 [karen]

...We need to determine the security properties

17:18:28 [karen]

...could be done with software or hardware

17:18:41 [karen]

...Strength of identity is implicit in the identity itself

17:18:54 [karen]

...for example, we have a trusted relationship with a device manufacturer

17:18:59 [karen]

...and can make decisions

17:19:00 [karen]

...privacy

17:19:13 [karen]

...device identifier is personally identifiable information

17:19:18 [AndroUser2]

AndroUser2 has joined #idbrowser

17:19:21 [AndroUser2]

AndroUser2 has joined #idbrowser

17:19:26 [karen]

...You need some type of user consent to give out to a given destination

17:19:37 [karen]

,,maybe dialogue boxes with certification is not best way

17:19:52 [karen]

...services need to be secure to users satisfaction

17:19:55 [Vladimir_]

Vladimir_ has joined #idbrowser

17:20:04 [karen]

...that user is going to right .com

17:20:17 [karen]

...We are not saying these are "the" requirements; they are our requirements

17:20:17 [fjh]

fjh has joined #idbrowser

17:20:21 [karen]

...not trying to generalize

17:20:24 [karen]

...we need input from others

17:20:33 [karen]

...that could be universally applicable

17:20:49 [karen]

...Java Script APIs for service device authentication is one possible approach

17:20:55 [jimklo]

jimklo has joined #idbrowser

17:20:57 [karen]

...First, possiblity to derive a temporary key

17:21:08 [karen]

...those temp keys should not be visible to Java Script code

17:21:19 [karen]

...should be secure to whatever level...of the platform device

17:21:23 [karen]

...Build whatever protocols you want

17:21:26 [karen]

...to make them secure

17:21:40 [karen]

...There are some services not possible today on the Web platform

17:21:48 [karen]

...secure device authentification is one

17:21:58 [karen]

...on browser side others interested in working on this

17:22:05 [karen]

Harry: Let's go next to Intel presentation

17:22:15 [karen]

...then Q&A and then go to a shorter break

17:22:20 [lowenthal]

are the slides online somewhere?

17:22:50 [karen]

Speaker is Jack Matheson, Intel's application and security products group

17:23:00 [karen]

Jack: this is a new area whe just christoned

17:23:07 [karen]

...mostly talking about platform problems

17:23:12 [karen]

...that is my interest and it is important

17:23:26 [karen]

...First I would like to acknowledge the notion of trust in this relationship

17:23:35 [karen]

...establish trust between you and your services

17:23:38 [karen]

...long-term support

17:23:46 [JeffH]

@karen -- at some point pls announce to group -- perhaps write on the flip chart -- how we can go access these IRC logs from ystdy & today. thanks!

17:23:59 [karen]

...Trust is predicated on user and their device

17:24:08 [karen]

...Problem here is a lot of things

17:24:19 [karen]

...think of device ids, hardware state or testing it

17:24:26 [karen]

...talking about a trusted third party to verify it

17:24:29 [karen]

...that's a big problem

17:24:35 [karen]

...not just in enterprise but also consumer

17:24:39 [karen]

...More philosophically

17:24:47 [karen]

...it's a problem because a device is owned by a user

17:24:56 [karen]

...not user centric but network centric

17:25:04 [karen]

...need a tie between the platform and the privacy of the user

17:25:13 [karen]

...that is not nec. solved by attestation

17:25:18 [karen]

...you can ping me later about hat

17:25:25 [karen]

...mostly stating problems today

17:25:33 [karen]

...Leads to second problem

17:25:43 [karen]

...if you want mass adoption, you need platform that gets to masses

17:25:48 [karen]

...why the platform is so important here

17:25:52 [karen]

...My interest in this workshop

17:26:02 [karen]

...I titled this hardware relevance

17:26:07 [karen]

...I think of browser

17:26:22 [karen]

....user agent has direct access to platform

17:26:30 [karen]

...hybrid solutions, software-device interactions

17:26:40 [karen]

...primary is low cost

17:26:46 [karen]

...If someone snaps a picture

17:26:57 [karen]

...it is very cheap to put on and it is massively adopted

17:27:03 [karen]

...everyone has a camera phone now

17:27:09 [karen]

...other things I will gloss over

17:27:16 [karen]

...Think of user-centric privacy

17:27:24 [karen]

...if a trusted third party is not user centric

17:27:35 [karen]

...and I have seen experiments of putting within device itself

17:27:50 [karen]

...Problem all of them face is that people in business of devices, hardware and platforms

17:28:03 [karen]

...no one wants to introduce legacy

17:28:04 [karen]

...solutions in platform

17:28:11 [karen]

...no one wants to support

17:28:30 [karen]

...So the problem here is that platform vendors want to support identity in a secure, user-centric way, but not in a proprietary way

17:28:34 [karen]

...closing example

17:28:36 [karen]

...TPN

17:28:45 [karen]

...way in which it got accepted is awesome

17:28:55 [karen]

...people who worked in trusted computing got together

17:29:03 [karen]

...so every laptop has a TPM chip

17:29:21 [karen]

...just the perfect example of why we need workgroups to create identity standards that are applicable to the platform

17:29:26 [karen]

Harry: now go to questions

17:29:35 [karen]

...20 minutes then break

17:29:54 [karen]

PHB: going back to other discussion about platforms

17:30:06 [karen]

...we have not decided about how to represent the account identifier

17:30:11 [karen]

...OpenID uses a URi

17:30:15 [karen]

...and type in..

17:30:26 [karen]

...look on web, way we federate accounts

17:30:46 [karen]

...if we can make that decision to use that same mechanism to represent an account across SAML, and OpenID and OAUth

17:30:53 [karen]

...we could all make that play nicely and simply

17:30:57 [karen]

...and how one relates to another

17:31:07 [karen]

JeffH: Phil makes a good point

17:31:11 [karen]

...a bit confused

17:31:20 [karen]

...what we people use to id ourselves in an online context

17:31:36 [karen]

...may or may not be mapped to what internally in the system is known as an account identifier under the hood

17:31:44 [karen]

...he is talking about user identifiers

17:31:48 [karen]

...we could leverage those

17:31:54 [karen]

...but not nec what gets mapped under hood

17:32:04 [karen]

...people wield multiple identifiers

17:32:17 [karen]

Phil: comes to how you interpret; whether you use DNS

17:32:31 [karen]

...identify provider at xyz.com or Fred a pqr.com

17:32:40 [yoiwa]

yoiwa has joined #idbrowser

17:32:41 [karen]

...have to decide if we are going to use the DNS and nothing else

17:33:00 [karen]

CarlH: In cases where customer has own equipment

17:33:10 [karen]

...it looks identity management should be in the platform

17:33:14 [karen]

...and be just another app

17:33:18 [karen]

...like Google chrome

17:33:23 [karen]

...could be standardized

17:33:31 [karen]

...to do that and have these apps work together

17:33:41 [karen]

...me having 40K apps on my iPhone that won't work together is crazy

17:33:47 [karen]

...so apps must work together on the platform

17:33:55 [karen]

...I didn't hear a revocation story from Dirk

17:34:05 [karen]

Dirk: I had the step of provisioning the account

17:34:08 [karen]

...just an OAuth flow

17:34:17 [karen]

...what fell out was an OAuth

17:34:27 [karen]

...service provider can show tokens

17:34:33 [karen]

Carl: could be tricky to explain

17:34:40 [CraigWi]

CraigWi has joined #idbrowser

17:34:49 [karen]

Dirk: page not very good, hard to discover; I think Facebook is doing a better job

17:34:54 [CraigWi]

q+

17:34:57 [karen]

...service provider knows the token has been issued

17:35:07 [karen]

Carl: should provide a reasonable summary

17:35:25 [karen]

DirK: could be a sitation to voluntarily give up token

17:35:37 [karen]

Carl: How can we explain to users what they have given out and what they can take back?

17:35:44 [karen]

DirK: with Android, you can uninstall

17:35:53 [karen]

...but revocation you have to do on server provider side

17:36:02 [karen]

Dave: a couple things

17:36:10 [karen]

...Jeff's comment of email address, I am a big fan of that

17:36:18 [CraigWi]

from a question yesterday, the Microsoft Security Intelligence Report is at http://www.microsoft.com/security/sir/default.aspx

17:36:18 [karen]

...if you use the @ sign you apply an email address

17:36:33 [karen]

...i dno't have an obvious solution, but we need simplifying assumptions

17:36:37 [karen]

...improve usability

17:36:48 [karen]

...bigger point, there may be low hanging fruit to improve usability

17:37:03 [karen]

...to point that improving usability is worth doing

17:37:06 [hhalpin]

hhalpin has joined #idbrowser

17:37:07 [karen]

...consistency is important

17:37:15 [hhalpin]

q+ craig

17:37:18 [hhalpin]

q+ nico

17:37:18 [karen]

Harry: Phil

17:37:18 [karen]

ack Phil

17:37:25 [hhalpin]

q+ a2

17:37:25 [benadida]

ack me, that was a while ago

17:37:25 [karen]

PHB: I agree with what Dave just said

17:37:35 [karen]

...I tried using ? in mark-ups

17:37:39 [benadida]

ack benadida

17:37:43 [karen]

...most sites require you to use an email account

17:38:00 [karen]

...If you want to aggregate more than a small number of accounts; this may not be your sole email

17:38:13 [karen]

...but it must have to have some email like properties and be used as a customer service account

17:38:16 [tyler]

q+

17:38:22 [karen]

Dave: it's a limiting assumption

17:38:36 [karen]

Dirk: an email address should be a standard attribute because it is pervasive

17:38:46 [karen]

...I don't think it should be "the" identifier of the account

17:38:48 [hhalpin]

ack CraigWi

17:38:51 [karen]

...just an attribute

17:38:52 [hhalpin]

ack craig

17:38:53 [karen]

ack Craig

17:39:04 [karen]

Craig: security analysis report

17:39:10 [karen]

...acc't manager in Honeycomb

17:39:16 [karen]

...MS has a full suite of capabilities

17:39:21 [karen]

...Windows probably sends

17:39:41 [karen]

...further investments in that space, plug-in model, may be worth noting

17:39:47 [karen]

...Phil said about deployment

17:39:52 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html tlr

17:39:58 [karen]

...deployment was both fantastic opportunity and failure

17:40:04 [karen]

...we thought we could get on all machines

17:40:09 [karen]

...but was first version, not improved

17:40:19 [karen]

...with need for deployment to evolve systems

17:40:19 [Brad]

Brad has joined #idbrowser

17:40:23 [karen]

...we won't get it right

17:40:33 [gape]

gape has joined #idbrowser

17:40:34 [karen]

...do get broad deployment and good site of timeline usability is important

17:40:46 [karen]

Sam: a solutoin for some use cases is to have a compoenent of web app

17:40:52 [karen]

...a library you can grad

17:41:00 [karen]

...you have evolution points within the platform

17:41:07 [karen]

...which could give you a better story

17:41:13 [karen]

...either one can bring new features to the other

17:41:15 [karen]

ack Nico

17:41:17 [hannes]

hannes has joined #idbrowser

17:41:18 [karen]

ack Tyler

17:41:19 [hhalpin]

ack nico

17:41:22 [hhalpin]

ack tyler

17:41:22 [karen]

Tyler: question for Netflix

17:41:28 [karen]

...you are user web technologies

17:42:02 [karen]

Mark: we do have user interface stuff in web environment

17:42:10 [karen]

...video streaming is pretty much under covers

17:42:22 [karen]

...we could put together a proposal of a Java Scipt API requirements

17:42:33 [karen]

Tyler: A strawman proposal would be good

17:42:54 [karen]

Harry: yes, we really do need strawman proposals to make work move forward; for more or less every group of passcode features in scope

17:43:03 [karen]

...we are trying to determine how much of device id is in scope

17:43:04 [hhalpin]

ack a2

17:43:30 [karen]

Q: Online acc't manager would also fall back to same issues as yesterday

17:43:33 [karen]

...go into form fill

17:43:35 [karen]

Phil: yes and no

17:43:36 [PhilWolff]

PhilWolff has joined #idbrowser

17:43:43 [karen]

...if site makes it too difficult for me, I don't use

17:43:50 [karen]

...like Huffington Post

17:43:50 [PhilWolff]

PhilWolff has joined #idbrowser

17:43:56 [karen]

...I will give up if it's too difficult

17:44:08 [karen]

...yes, there are idiot web managers that want to control the user experience

17:44:16 [karen]

...and then they become unemployed

17:44:20 [karen]

Q: they are still there

17:44:33 [karen]

Phil: some you cannot reach; if you can get 80-90 percent in, better than zero

17:44:42 [karen]

Q: we make one, I agree, but still suffer

17:44:44 [karen]

...no standard

17:45:10 [karen]

Q: for Intel, from hardware platform perspective, where are the manufacturers in coming up with a standard

17:45:16 [karen]

...why not start at platform and build up

17:45:30 [karen]

...where are we? What is Intel, AMD, as an industry

17:45:38 [karen]

A: No agreement what we need

17:45:51 [karen]

...people like me who approach more philosophically and the business side

17:46:07 [karen]

...no one will use Id priviledges unless there is mass adoption

17:46:23 [karen]

Q: sort of schizophrenic

17:46:33 [karen]

A: lots of things Intel is working on

17:46:40 [karen]

Q: no standards body working on that?

17:46:48 [karen]

Harry: at W3C we work on more Webby things

17:46:57 [karen]

Q: For Google we talked about the "ok" button

17:47:08 [JeffH]

who's the guy asking these good questions?

17:47:11 [karen]

...Ok comes onto screen so fast; you grant permission to get information

17:47:21 [karen]

...have you thought through usability of those who don't want to give approval?

17:47:28 [karen]

Dirk: Google screens are the standard

17:47:33 [karen]

...that we implemented

17:47:46 [karen]

...whatshould go on those consent screens is an interesting problem

17:47:54 [karen]

...informed consent; versus check boxes

17:48:02 [karen]

...yes, it's an interesting problem we are looking at

17:48:10 [karen]

...but a bit orthogonal to identity in the browser

17:48:16 [karen]

...to me it seems like a trust issue

17:48:22 [karen]

...either I trust or I don't

17:48:25 [karen]

...if I trust, they are ok

17:48:43 [karen]

Sam: more like I trust them or I trust them; have you ever said no?

17:48:52 [karen]

Dirk: yes, I have said not

17:49:13 [karen]

Q: If you install an app that asks for phone calls when you want to play a game, you still say yes

17:49:27 [karen]

Dirk: I look at number of stars, who recommended it

17:49:34 [karen]

Harry: Nico, Dominique

17:49:47 [karen]

Nico: to comment on the Android, I want to say, no I don't want that priviledge

17:49:59 [karen]

...I liked your presentation

17:50:07 [karen]

...you exemplified what you can do with a framework and APIs

17:50:14 [karen]

...some of what you showed is somewhat I envision

17:50:22 [karen]

...so you, me and him need to get together

17:50:29 [karen]

Dirk: you are not only one who wants that feature

17:50:45 [karen]

Dominique: I am curious to know scheme of user creating account

17:50:49 [karen]

...how do you deal with elevations

17:50:55 [karen]

...transactions may have a higher value

17:51:00 [karen]

...how do you protect that information

17:51:13 [karen]

...if someone else assume the account of that indiv, but not real person, how do you tell?

17:51:24 [karen]

Dirk: first part of question goes into transaction based authorization

17:51:33 [karen]

...at that point in time I need additional authorization from the user

17:51:48 [karen]

...When you install account, an OAuth token could be used

17:51:56 [karen]

...but not powerful enough to approve all transactions

17:52:15 [JeffH]

on a technical level, an "oauth token" is a "capability"

17:52:16 [karen]

...then service provider sees they are using an OAuth; could send an sms to them

17:52:23 [karen]

Dominique: so resides at service provider?

17:52:33 [karen]

Dirk: yes, service provider decides about OAuth token

17:52:55 [karen]

Q: What if developer asks to turn feature off?

17:53:06 [karen]

Harry: to summarize

17:53:08 [PhilWolff]

Did anyone answer the question raised by Intel about hardware baking in identity protocols that fail to update and keep up?

17:53:10 [karen]

...needs to work with platform

17:53:17 [karen]

...account manager, account manager

17:53:22 [karen]

...help Phil's cloud scheme

17:53:24 [karen]

...show of hands

17:53:29 [karen]

...should we scope ourselves

17:53:34 [karen]

...outside browser mechanisms

17:53:39 [karen]

...The statement is

17:53:42 [karen]

...scoping statement

17:53:58 [karen]

...strong consensus about account managers working outside browsers and in the cloud

17:54:04 [karen]

...yes, we should go outside browser

17:54:18 [karen]

[half room says yes]

17:54:23 [karen]

[no hands for no]

17:54:38 [karen]

...Next, yes device ID should be within scope

17:54:46 [karen]

[about half room shows hands]

17:54:50 [karen]

[a few no hands]

17:55:04 [karen]

Sam: another question, is it valuable to see what IETF is doing

17:55:06 [karen]

...and try to align

17:55:08 [jimklo]

jimklo has joined #idbrowser

17:55:18 [karen]

Nico: in a device, identity comes from platform or the hardware

17:55:30 [karen]

Sam; yes, I agree; but is it desirable for us to work with IETF

17:55:43 [karen]

Harry: I assume answer is yes to work with IETF

17:55:54 [karen]

Mark: you are also thinking about platform capability

17:56:01 [karen]

...whether keys represent you or the device

17:56:04 [JeffH]

my thought is that the particular notion of "device id" that the netflix folks are arguing for is imv a somewhat separable problem

17:56:11 [karen]

Sam; on Android, device id cuold be another account

17:56:17 [karen]

nico: we want to bake a framework in

17:56:22 [karen]

...another one for user id

17:56:26 [karen]

...want ability to have them

17:56:42 [karen]

John Linn: these two topics are valid area of standardization, yes

17:56:52 [karen]

...if it's W3C or others to approach, should discuss

17:56:53 [JeffH]

also, there may be existing work that can be leveraged for "device id" and it isn't necessarily something that needs to be reinvented

17:56:55 [karen]

Harry: good point

17:57:01 [karen]

...one of reason ISOC is co-chairing

17:57:13 [karen]

...is I do believe W3C is happy to coordinate with IETF in this area

17:57:25 [karen]

JeffH: this device Id stuff could largely be done from a protocol perspective

17:57:30 [tlr]

(also, the W3C liaison to the IETF is sitting in the second row and nodding)

17:57:32 [karen]

...in other contexts, don't reinvent it

17:57:43 [karen]

Harry: we will have a protocol discussion in the afternoon

17:57:48 [karen]

...sorry ten minute break

17:57:55 [karen]

rrsagent, make minutes

17:57:55 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html karen

17:58:03 [karen]

rrsagent, make mintues

17:58:03 [RRSAgent]

I'm logging. I don't understand 'make mintues', karen. Try /msg RRSAgent help

18:03:12 [dpranke]

dpranke has joined #idbrowser

18:07:14 [fjh]

fjh has joined #idbrowser

18:07:40 [wbaker]

wbaker has joined #idbrowser

18:13:01 [josephboyle]

josephboyle has joined #idbrowser

18:19:11 [bkihara]

bkihara has joined #idbrowser

18:20:11 [tlr]

rrsagent, draft minutes

18:20:11 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html tlr

18:20:21 [tlr]

tlr has changed the topic to: http://www.w3.org/2011/05/25-idbrowser-minutes.html

18:21:17 [PHB]

PHB has joined #idbrowser

18:21:44 [PHB]

Standing in for Kaliya

18:21:49 [tlr]

ScribeNick: PHB

18:22:01 [PHB]

Ideas for user centricity -

18:22:15 [PHB]

Usability is important

18:22:37 [PHB]

This group is not the default, people can act out online without consequences

18:22:44 [nico]

nico has joined #idbrowser

18:22:48 [PHB]

People use multiple personas, particularly women

18:23:28 [PHB]

Ways to let people manage their own data online

18:23:50 [PHB]

Critical thing is to allow users to have multiple persona

18:23:55 [nico]

I'm curious why women might have more online personas than men, and where's the data to back that up :)

18:24:13 [PHB]

Organized conference earlier this year - she is geeky

18:24:34 [PHB]

Users had 2 facets by default

18:24:45 [nico]

ah, there's the data

18:25:04 [PHB]

Women had an average of 6 facets, some must have had far more to make average

18:25:23 [PHB]

Being seen vs being watched vs being stalked

18:25:46 [PHB]

Being seen is bidirectional

18:25:58 [PHB]

Being watched is unidirectional

18:26:06 [mixedpuppy]

mixedpuppy has joined #idbrowser

18:26:15 [PHB]

Being stalked is aggregating across multiple sources

18:26:25 [bblfish]

bblfish has joined #idbrowser

18:27:01 [PHB]

Personal data services

18:27:02 [fjh]

fjh has joined #idbrowser

18:27:16 [PHB]

users control their own data, users can share and trade in ways that they control

18:27:21 [dpranke]

Is "stalking" an established term in this space

18:27:24 [PHB]

Can get free flights!!

18:28:41 [dpranke]

I fear it may be overly charged or polarizing

18:29:30 [zolli]

zolli has joined #idbrowser

18:29:50 [PHB]

Mary-Ann Hona

18:29:54 [PHB]

Hondo

18:30:06 [PHB]

The IBM presentation

18:30:11 [PHB]

The Nexus of identity

18:31:00 [PHB]

Users want two control knobs

18:31:16 [PHB]

one is transparency

18:31:44 [PHB]

Presenting aggregate IBM opinion is hard (!)

18:31:48 [PHB]

yes to everything

18:32:08 [PHB]

Lets do whatever we can to improve usability scalability security

18:32:14 [dveditz]

dveditz has joined #idbrowser

18:32:17 [hhalpin]

hhalpin has joined #idbrowser

18:32:40 [PHB]

In addition to the base products, research into vulnerabilities

18:33:00 [PHB]

acquired company now our X-force group, usability & security

18:33:35 [PHB]

track vulnerabilities, policies, risk based policies and controls

18:33:55 [PhilWolff]

Hodder: ID managers should help users apply/admin personae from the browser, not just authentication.

18:33:58 [PHB]

what exactly wold a well behaved mobile app look like?

18:34:13 [PHB]

identity support outside the browser

18:34:28 [PHB]

less concerned about what it is than being able to talk about it in a common way

18:34:38 [PHB]

Our vision

18:34:54 [PHB]

zurich lab has worked with EU on privacy issues

18:35:11 [PHB]

vision from lab is that users can interact in a safe and secure way

18:35:38 [PHB]

identity mixer, a flexible cryptographic framework

18:35:42 [PHB]

access control

18:35:50 [PHB]

EU projects to make it real

18:36:18 [PHB]

proofs of claims such as 'i am between 12 and 15 years old

18:36:24 [PHB]

can be used with smartcards

18:36:39 [PHB]

addresses all requirements of privacy protecting PKI

18:36:56 [PHB]

Who are you vs access ??? (slide gone)

18:37:18 [PHB]

Resources www.Primelife.eu

18:37:25 [PHB]

(contacts in slides)

18:37:45 [PHB]

TLR: European host of W3C is a participant in that project

18:37:53 [PHB]

Next speaker:

18:38:00 [tlr]

... as are several W3C staffers

18:38:05 [tlr]

(Rigo, Dave Raggett, myself)

18:38:21 [PHB]

John Tolbert from The Boeing Company

18:38:27 [PHB]

History

18:38:44 [PHB]

Talk about identity, use identity for access control

18:39:05 [PHB]

Histor: Users, Groups, ACLs, to Risk Adep AC

18:39:23 [PHB]

Can't say we have got off the simple stuff in some cases.

18:39:28 [PHB]

Machinery of identity

18:39:47 [PHB]

LDAP, Web Access management and so on, PKI, SAML, smartcards

18:40:04 [PHB]

Encouraged by whay I have heard

18:40:17 [PHB]

interested in combination of user and device identity

18:40:39 [PHB]

Get wrapped up in aerospace, defense type world

18:40:50 [PHB]

finance, social media type

18:41:12 [PHB]

use web access management internally extensively

18:41:18 [PHB]

1000s of applications (not users!)

18:41:37 [PHB]

external connection get into

18:41:50 [PHB]

identity is a piece of the puzzle

18:41:53 [PHB]

evrything goes into the middle, access control

18:42:44 [PHB]

Empower people in global trade controls, to author policy and make access control decisions

18:42:59 [PHB]

environment matters, who a person is, where there device is

18:43:05 [PHB]

being able to prove that strongly

18:43:18 [PHB]

identity providers

18:43:31 [PHB]

nobody in this country would go for a national identity card

18:43:43 [PHB]

bottom up may provide what we need in that area

18:44:12 [PHB]

mention the unmentionable - advanced persistent threats

18:44:34 [PHB]

identity in browser can be compromised, for naught if machine is compromised

18:44:44 [PHB]

skip through data protection for time

18:45:08 [PHB]

cryptographic standards needed to bind metadata to data for access control decisions

18:45:31 [PHB]

look to how we can leverage info from groups like trusted computing , extend existing standards, SAML etc

18:46:03 [PHB]

Next speaker

18:46:16 [PHB]

Yahoooooo!

18:46:28 [PHB]

Wendel Baker from right media

18:46:42 [PHB]

Provide open marketplace where Yahoo can buy and sell ads

18:46:54 [PHB]

Pay the bills by monetization

18:46:59 [PHB]

two systems in Yahoo

18:47:05 [PHB]

ONO - Owned and operated

18:47:14 [PHB]

sold on guaranteed basis like a newspaper

18:47:15 [fjh]

fjh has joined #idbrowser

18:47:27 [PHB]

hand money (make good) if can't make display

18:47:49 [PHB]

This is the other system does the infill

18:48:01 [PHB]

How the internet world thinks about monetization

18:48:01 [zolli]

zolli has joined #idbrowser

18:48:21 [PHB]

audience side - getting people to come and read stuff, use service

18:48:26 [PHB]

need to get people to register

18:48:37 [PHB]

how to manage identity in terms of profiles and so forth

18:48:45 [PHB]

goals have is to have more fun

18:48:52 [PHB]

more personalization more interest

18:48:56 [PHB]

does not get any money

18:49:10 [PHB]

two monetize charge people or you do advertising

18:49:25 [PhilWolff]

@dpranke stalking is used for this type of asymmetry among online social science researchers

18:49:27 [PHB]

joke in VC community and can't work out how to monetize become an ad network

18:49:55 [PHB]

to make this interesting need to do more than just push pictures in front of people

18:50:09 [PHB]

need to tailor ad to the viewer

18:50:25 [PHB]

match between who the audience is, set of advertisers and the browser

18:50:45 [PHB]

Someone is providing the venue, set of advertisers would like access to opportunity and the viewer

18:51:03 [PHB]

today are two systems and they are unconnected for various reasons including policy

18:51:16 [PHB]

when you log in you get to choose screen name etc

18:51:35 [PHB]

advertising side is assigned to you by advertiser, public policy space

18:51:48 [PHB]

key about advertising is that you don't have to interact with that

18:52:05 [PHB]

don't need to know very much about the person on the other side of the wire

18:52:21 [PHB]

rough idea that have seen this guy before

18:52:34 [PHB]

amount of time that a buyer is focusing on the metrics is short

18:52:45 [PHB]

audience side identity systems

18:53:10 [PHB]

users should not need to sign in to use this site

18:53:39 [PHB]

users who log in via open id or whatever are better users, spend longer time, play more games etc

18:54:08 [PHB]

other way

18:54:19 [PHB]

got to be some way of identifying site

18:54:33 [PHB]

three screen strategy or four screenm

18:54:47 [PHB]

trying to relate what is going on in the online space to tv, mobile and other

18:54:54 [PHB]

web is the center

18:55:22 [PHB]

vision is that you should be able to do something on your tv, go to the web, mobile and its all the same stuff

18:55:35 [PHB]

need a way to link the identity across the devices so that you know its the same user

18:55:42 [PHB]

other side of the house

18:56:00 [PHB]

everything goes through the exchange that resolves 'who gets the ad'

18:56:24 [PHB]

this notion of who the user or the device is is not tied to what is seen before

18:56:42 [PHB]

advance going on today is linkage between different exchanges

18:56:56 [PHB]

to do that need to map the identity between different marketplaces

18:57:12 [PHB]

very important exchange wants to maintain its idea of who a user is

18:57:17 [PHB]

but need to match up

18:57:21 [PHB]

two sides

18:57:30 [PHB]

voluntary identity, vs forced identity

18:57:48 [PHB]

how strong and by what method should we tie these mechanisms?

18:58:43 [PHB]

Speaker: Chadwick

18:59:04 [PHB]

Trusted Attribute Aggregation

18:59:06 [PHB]

TAAS

18:59:26 [PHB]

Paypal people think of it as a broke

18:59:30 [PHB]

few sites

18:59:34 [PHB]

electronic shopping site

18:59:37 [PHB]

said student

18:59:43 [PHB]

comes to shopping payment time

18:59:54 [PHB]

need a credit card, postal address and student card

19:00:00 [PHB]

two attributes from user

19:00:08 [PHB]

one from bank (credit card)

19:00:14 [steve_schultze]

steve_schultze has joined #idbrowser

19:00:16 [PHB]

and one from schoo (student card

19:00:25 [PHB]

Policy for getting onto the site

19:00:40 [PHB]

is a mime type that causes a plugin to be activated by the browser

19:00:46 [PHB]

user clicks on bookmark

19:00:52 [PHB]

this stops a phishing attack

19:01:02 [PHB]

selects trusted service provider

19:01:19 [PHB]

can use any auth syustem you want we use username and password

19:01:26 [PHB]

has taken policy of the search provider

19:01:34 [PHB]

and filtered it according to the user

19:01:43 [PHB]

got some names and got some addresses

19:02:00 [PHB]

can have an official name given by the government or a name chosen by user

19:02:07 [PHB]

can do a gift purchase

19:02:10 [PHB]

can submit

19:02:24 [PHB]

or save and submit where the system remembers and gets one click shopping

19:02:41 [PHB]

now can go back and get single click shopping

19:02:49 [PHB]

single sign-on from SAML etc

19:03:10 [PHB]

another example from UK e-gov work

19:03:19 [PHB]

to get parking permit must have proof of car ownership

19:03:26 [PHB]

proof od pension

19:03:29 [PHB]

credit card

19:03:45 [PHB]

government currently only doing aggregation of government attributes

19:04:25 [PHB]

this time when user chooses name the only one that works is the officially certified name

19:04:42 [PHB]

user can't choose bill gates, has to match policy from search provider

19:05:01 [PHB]

goes back to site and site says these are attributes that were provided to me

19:05:13 [PHB]

if happy with that can get permit sent in post.

19:05:21 [PHB]

uses SAMLv2

19:05:30 [PHB]

(read slide summary of featues)

19:07:07 [PHB]

similar features today to what Microsoft and IBM will provide in ten years time

19:07:34 [PHB]

Demo is at (someone else must type)

19:07:37 [PHB]

username is guest

19:07:38 [hhalpin]

can someone near the front type that URI into IRC?

19:07:44 [PHB]

passwpord is password

19:07:54 [hober]

s/guest/Guest/

19:08:01 [PHB]

(high security here!)

19:08:09 [PHB]

Time check, we is an hour late

19:08:13 [PHB]

20 mins for discussion

19:08:53 [PhilWolff]

PhilWolff has joined #idbrowser

19:09:13 [PHB]

Dirk? Wicked does not mean bad

19:09:22 [jkmathes]

jkmathes has joined #IDBrowser

19:09:27 [PHB]

Stalking has connotations... is this intentional

19:09:31 [PHB]

loaded term

19:10:08 [nico]

"stalker economy"

19:10:17 [PHB]

?? well, refering to it as stalker economy is that we see people using info in malicious ways

19:10:32 [PHB]

people selling life insurance go online

19:10:38 [dpranke]

dpranke has joined #idbrowser

19:10:40 [PHB]

health insurers

19:10:48 [PHB]

not just you but your friends

19:10:56 [PHB]

so its all kinds of ways

19:11:00 [PHB]

q+

19:11:05 [PHB]

dossiers being compiled

19:11:19 [JeffH]

q+ JeffH

19:11:25 [PHB]

Dan schuster

19:11:28 [nico]

so act anonymously then?

19:11:32 [PHB]

legitimate needs of privacy

19:11:39 [PHB]

trying to support them is chasing tail

19:11:50 [PHB]

can obtain all the information from a variety of sources

19:11:59 [PHB]

photos announcement of church etc

19:12:19 [PHB]

niothing to do with whether know full birthday, who I am etc

19:12:46 [nico]

See Spokeo for a freaky example. As the chairman of a past employer said: "you have no privacy, get used to it"

19:12:47 [PHB]

is complicating id metasystem, but agent can get same info more easily

19:12:51 [yoiwa]

yoiwa has joined #idbrowser

19:12:58 [PHB]

name and age bracket plus zip is enough to identify you

19:14:19 [jkmathes]

jkmathes has joined #IDBrowser

19:15:11 [tlr]

q?

19:15:23 [PHB]

Speaker Jon

19:15:36 [PHB]

Speaker Harry:

19:15:40 [nico]

Enough personal info arguably is identity...

19:15:42 [tlr]

queue=PHB, JeffH

19:15:50 [PHB]

Quicj question at Mary: is google a personal id system

19:16:01 [PHB]

yes

19:16:11 [PHB]

Wendel: device ID in paper

19:16:25 [PHB]

need complex schemes to track people to real id on their net

19:16:32 [PHB]

what is the process to

19:16:42 [hhalpin]

actually I think Mary said "maybe"

19:16:51 [PHB]

netflixy based hardware id is bettrer, have number and can just work with it

19:16:52 [hhalpin]

which does make me wonder what is NOT a personal data store.

19:17:08 [PHB]

scale of the yahoo audience must be lots of

19:17:09 [hhalpin]

Perhaps Wendell's ad-tracking system would not be one, as I am not aware of it per se

19:17:30 [PHB]

state kept, device id would make it simpler, reduce gear, costs, co-lo space and so on.

19:18:34 [mixedpuppy]

mixedpuppy has joined #idbrowser

19:18:57 [PHB]

John Linn:

19:19:12 [PHB]

Trusted components

19:19:14 [bradhill]

ack PHB

19:19:16 [PHB]

is underspecified

19:19:22 [PHB]

should be by whom and for what

19:19:31 [PHB]

(PHB and does not mean trustworthy)

19:19:52 [PHB]

firefox plugin is an adblocker will undo an aspect of the system

19:20:01 [PHB]

need to recognize there are components

19:20:11 [PHB]

different entrants and for different purposes

19:20:21 [PHB]

we engineered it to minimize the trust component

19:20:33 [PHB]

never asks for username and password

19:20:50 [PHB]

(Chadwick) I don't know who you are, idp does not know

19:20:58 [PHB]

aggregator merely aggregates tuples

19:21:10 [PHB]

minimize the amount of trust required in it

19:21:23 [PHB]

will only release links to the entity that gave it to them

19:21:41 [PHB]

trust is a major issue

19:21:56 [PHB]

Tom ?

19:22:12 [karen]

Tantek Celik speaking

19:22:12 [PHB]

Economics, pick any

19:22:23 [PHB]

zero to know cost to check anyone in your system

19:22:41 [PHB]

zero cost to stalk everyone makes a very bad system

19:23:05 [PHB]

Jeff Hodges: This is really important stuff but layer 9

19:23:14 [PHB]

legislation and policy trather than technology

19:23:20 [PHB]

??

19:23:30 [PHB]

(can't hear)

19:23:38 [PHB]

I just want to be this person for today

19:23:43 [bradhill]

ack JeffH

19:23:49 [PHB]

David singer above

19:24:06 [karen]

Greg Kerr, AuthenTec was speaking

19:24:16 [PHB]

Dan: brute force is not as difficult as people imagine.

19:24:34 [PHB]

Sam H.: anonymity and unlinkability is harder than you think no matter what

19:24:56 [PHB]

agree with jeff, every if statement in your code is a potential linkability issue

19:25:07 [PHB]

have bought 40 minutes

19:27:07 [JeffH]

OMG -- Carl Hewitt has an even bigger gear bag than me....

19:27:16 [JeffH]

:)

19:27:38 [PHB]

Dan Schuster

19:27:39 [dpranke]

dpranke has joined #idbrowser

19:28:11 [PHB]

what is different now that would make it a good time to be making changes?

19:28:22 [PHB]

much greater sophistication in malware and fraud etc than before

19:30:20 [PHB]

Government drive

19:30:23 [PHB]

Smartphones

19:30:33 [PHB]

Social networks etc

19:30:39 [PHB]

now may be the time to see things happen

19:30:42 [PHB]

barriers

19:30:52 [nico]

Are logs of this channel being kept?

19:31:00 [PHB]

(summary is in slides)

19:31:05 [nico]

If so, where?

19:31:23 [PHB]

hard to displace historical precedence

19:31:37 [PHB]

must be easier to use, to interface to

19:32:16 [JeffH]

@nico -- apparently irc.w3.org keeps logs and there's a std way to get to them. i dunno offhand what it is. TLR said they'd let us know

19:32:30 [RRSAgent]

I have made the request to generate http://www.w3.org/2011/05/25-idbrowser-minutes.html tlr

19:32:55 [nico]

JeffH, tlr: danke

19:33:21 [PHB]

Financial services: need mutual authentication

19:34:10 [PHB]

(break to find slide)

19:34:15 [PHB]

Don Thibeau Open ID

19:34:26 [PHB]

OIX /NSTIC and path forward

19:34:52 [PHB]

NSTIC talks about an identity ecosystem

19:35:01 [PHB]

new animals in mix - regulators

19:35:13 [PHB]

lawyers, auditors, policy makers

19:35:29 [PHB]

dependency on a new type of infrastucture

19:35:43 [PHB]

lbrings lawyers and accountants into the conversation

19:35:47 [JeffH]

"send lawyers, guns, and money!!@%^" -- warren zevon

19:36:06 [PHB]

Public Private Partnership workshops to kick of in two weeks

19:36:24 [PHB]

Open Identity Exchange is in response to a US govt request

19:36:41 [PHB]

asked openID foundationto participate

19:37:04 [PHB]

How to deliver more service as budgets decline

19:37:09 [PHB]

online and in the cloud

19:37:15 [PHB]

need to solve the identity problem

19:37:23 [PHB]

Open Id Exchange

19:37:36 [PHB]

(PHB does this look like Liberty Alliance?)

19:38:28 [PHB]

restructure other identity providers from telco space

19:38:30 [PHB]

and people in data aggregation biz

19:38:32 [dpranke]

dpranke has joined #idbrowser

19:38:49 [PHB]

OIX is center of gravity to sort out what it means to become a trust framework

19:39:16 [PHB]

OIX is trying to do is to become the partner in the public-private partnership

19:39:23 [PHB]

private sector will lead

19:39:31 [PHB]

what are the goals?

19:40:07 [PHB]

technology + policy

19:40:22 [PHB]

policy interoperability + technical interop = trust framework

19:40:30 [PHB]

truste by whom and for what

19:41:15 [PHB]

OIX is providing plumbing, and best practices

19:41:26 [PHB]

plumbing is rules + tools

19:41:36 [PHB]

RISK Wiki

19:41:45 [PHB]

knowledge center where people can post stuff

19:41:58 [PHB]

pull from the risk wiki components they can re-use

19:42:13 [PHB]

set of tools , metadata listing service

19:42:27 [PHB]

what are requirements for each provider

19:44:41 [PHB]

pilots taking place

19:44:49 [dveditz]

dveditz has joined #idbrowser

19:44:50 [PHB]

bine email address to postal address (etc)

19:45:28 [yoiwa]

yoiwa has joined #idbrowser

19:46:27 [PHB]

Francisco Corella on the NSTIC

19:47:15 [PHB]

One goal of NSTIC is to get rid of passwords

19:47:24 [PHB]

is being achieved right now with social login

19:47:43 [PHB]

or by other social site like myspace or linked in

19:47:46 [PHB]

is this good?

19:47:50 [PHB]

unfortunately not

19:48:01 [PHB]

current social login is moving us in wrong direction

19:48:13 [PHB]

social site can track users login

19:48:20 [PHB]

allows credential to be sent enclair

19:48:43 [PHB]

so use facebook at cafe with wifi it is very easy for hacker to attack you

19:49:05 [PHB]

specific to OAUTH is that rp must register with the site

19:49:16 [PHB]

so if login with facebook becomes ubiquitous

19:49:28 [PHB]

facebook controls the web, can revoke registration

19:49:37 [PHB]

reinforces facebook monopoly

19:49:52 [PHB]

can't persualde rps to register with them

19:50:03 [PHB]

competitor can't persualde rps to register with them

19:50:19 [PHB]

zero knowledge proof like IBM or uprove or

19:50:31 [PHB]

need an interim soliution

19:50:39 [PHB]

will take time

19:50:54 [PHB]

having interim solution makes it possible to develop framework

19:51:02 [PHB]

ahead of the zero knowledge proof

19:51:24 [PHB]

HTTP extension for delegated identity

19:51:28 [PHB]

(details on slide)

19:53:47 [dpranke]

dpranke has joined #idbrowser

19:54:56 [PHB]

Dan Schuster back

19:56:24 [PHB]

Speaker Thomas J. Smedinghof

19:56:43 [PHB]

from ABA identity management legal taskforce

19:56:50 [PHB]

defining what it is

19:57:09 [PHB]

came down to looking at it from 50,000 fott level to two buckets of items

19:57:16 [PHB]

tools and rules

19:57:30 [PHB]

operational specifications

19:57:34 [PHB]

legal rules

19:58:52 [fjh]

fjh has joined #idbrowser

19:59:39 [PHB]

need to understand law when developing the rules

19:59:50 [PHB]

sometimes causes problems, sometimes fills in blankc

20:00:05 [PHB]

privacy is heavily regulated in the EU

20:00:14 [PHB]

in healthcare in the us

20:00:24 [PHB]

can't stand up rules for privacy that violate them

20:00:33 [PHB]

but may not cover everything

20:00:53 [PHB]

a dozen states regulate security for all companies

20:01:06 [PHB]

different countries used to regulate encryption in different ways

20:01:09 [PHB]

the law is there

20:01:20 [PHB]

the same thing happens with the legal rules

20:01:25 [PHB]

body of law is out there

20:01:31 [PHB]

but don't know what it says

20:01:40 [PHB]

what is your liability?

20:01:49 [PHB]

what is liability of browser vendor for liability?

20:01:57 [PHB]

in password manager?

20:02:07 [PHB]

legal rules can define that liability

20:02:11 [fjh]

q+

20:02:22 [PHB]

how mucgh each party agrees to bear and so forth

20:02:37 [nico]

This isn't a legal issue yet, it's a political issue first

20:02:40 [PHB]

can specify in contract or default in existing law

20:02:48 [PHB]

(PHB - mention the rulebook approach)

20:03:05 [nico]

eventually it may also be a legal issue

20:03:26 [PHB]

can do it through statue or regulation

20:03:42 [PHB]

(will lag, be incomplete)

20:03:51 [PHB]

need some sort of contractual structure

20:03:59 [PHB]

facebook does have a contract

20:04:03 [PHB]

agree by clicking

20:04:04 [JeffH]

Tom providing a good overview of why we -- eg in "identity biz" -- need to pay attention to Layer 9 (legal/regulatory/contractural) issues

20:04:20 [PHB]

look at Identrus PKI suystem 4000 pages

20:04:28 [PHB]

can do it in a lot of different ways

20:04:37 [PHB]

common legal barriers

20:04:38 [steve_schultze]

q+

20:04:42 [PHB]

key issues

20:04:44 [PHB]

q+

20:04:57 [dveditz]

dveditz has joined #idbrowser

20:05:00 [PHB]

(describes slide)

20:05:05 [paul]

paul has joined #idbrowser

20:06:26 [dpranke]

q+

20:07:11 [wbaker]

wbaker has joined #idbrowser

20:07:14 [PHB]

ways to establish contracts

20:07:23 [PHB]

credit card model

20:07:30 [PHB]

non participants, how can they be injured

20:07:35 [PHB]

not a party to the system

20:07:44 [PHB]

what are their rights

20:07:46 [PHB]

open question

20:08:06 [PHB]

back to

20:08:13 [PHB]

Dan Schuster

20:08:48 [PHB]

requirements wish list

20:08:49 [nico]

nico has joined #idbrowser

20:08:59 [PHB]

want to set up a secure trusted authenticated path

20:09:17 [PHB]

authenticate all information that is exchanged

20:09:27 [PHB]

sufficiently granular

20:09:42 [PHB]

(delgates can act for others etc

20:09:55 [PHB]

Decouple proofing authentication and authorization

20:09:56 [CraigWi]

q+

20:11:18 [PHB]

(summary is on slides)

20:15:52 [bradhill]

ack fjh

20:15:56 [PHB]

frederick:

20:16:02 [PHB]

legal stuff is important

20:16:12 [PHB]

sets direction ut not detail

20:16:19 [PHB]

case law resolves detail

20:16:30 [PHB]

fast time to market for business reasons

20:16:37 [PHB]

how can sync the two up

20:16:38 [PhilHunt]

PhilHunt has joined #idbrowser

20:16:53 [hhalpin]

q?

20:16:57 [PHB]

speaker: law is always behindd and don't know in the interim, make up own rules

20:17:05 [hhalpin]

q+ hannes

20:17:44 [hhalpin]

ack steve_schultze

20:18:11 [PHB]

steve:

20:18:18 [PHB]

hoping to rely on contracts

20:18:33 [PHB]

how reasonably would they make their way to relying parties

20:18:46 [PHB]

relying partiy agreements, how do they bing the RP?

20:18:50 [PHB]

bind

20:19:04 [Vladimir_]

Vladimir_ has joined #idbrowser

20:19:11 [PHB]

are there universes in which there are contracts that might bind end users?

20:19:24 [fjh_]

fjh_ has joined #idbrowser

20:19:39 [PHB]

Thomas: hard to do in open environment

20:19:54 [PHB]

easy to get Amazon, Ebay to agree

20:20:00 [PHB]

hard to get consumers

20:20:17 [PHB]

Don - that is the opportunity of a trust framework

20:20:33 [PHB]

solves problems of bilateral contracts

20:20:39 [hhalpin]

ack PHB

20:20:54 [tlr]

phb: faced open contracts problem when we founded a certain large CA

20:20:58 [fjh]

q?

20:21:00 [tlr]

... one of the approaches was a rulebook mechanism

20:21:11 [tlr]

.. join an exchange - there's a rule book that everybody has a bilateral contract with the rulebook

20:21:14 [tlr]

... that then mediates disputes

20:21:15 [tlr]

.

20:21:17 [tlr]

s/.//

20:21:25 [tlr]

... avoids need for everybody to have bilateral contract with everybody else

20:21:29 [tlr]

... didn't get to point of requiring that

20:21:31 [JeffH]

fyi: Steven Roosa – The Devil is in the Indemnity Agreements: A Critique of the Certificate Authority Trust Model’s Putative Legal Foundation http://citp.princeton.edu/events/lunch/steven-roosa/

20:21:34 [tlr]

... audience tag in SAML was inspired by that

20:22:09 [hhalpin]

http://etherpad.mozilla.org:9000/V0zRDKeAU0

20:22:13 [tantek]

tantek has joined #idbrowser

20:22:15 [PHB]

don: NYSE is the referree for the transactions

20:22:17 [hhalpin]

http://etherpad.mozilla.org:9000/V0zRDKeAU0

20:22:24 [hhalpin]

etherpad for open discussion lighting proposal sign-up

20:22:26 [hhalpin]

URI above

20:22:37 [PHB]

Thomas, is a common appraoch, has lot opf merit

20:22:41 [hhalpin]

q?

20:22:42 [PHB]

how to bind consumer?

20:22:51 [PHB]

Dirk:

20:22:55 [hhalpin]

ack dpranke

20:23:32 [tantek]

hhalpin - I added the form annotation straw proposal you asked me to do to the etherpad

20:23:36 [PHB]

how does the browser into the rp thing?

20:23:50 [PHB]

large body of work wrt the duties of the identity provider

20:23:56 [PHB]

less for the relying parties

20:24:27 [hhalpin]

q?

20:25:26 [hhalpin]

ack CraigWi

20:25:33 [PHB]

Thomas: depends on how you set up the system, can vary from none to much

20:25:42 [PHB]

DirK : is it too early for me to tell

20:25:50 [nico]

nico has joined #idbrowser

20:26:29 [PHB]

craig: in what way is the user directly involved?

20:26:33 [hhalpin]

q?

20:26:35 [hhalpin]

q+ a2

20:26:47 [PHB]

Don: got one experiment going on now

20:26:55 [jimklo]

jimklo has joined #idbrowser

20:27:08 [PHB]

gives user ability to control what they expose etc.

20:27:28 [PHB]

proxy model, terms of service between myself and AOL becomes fabric in which all is taking place

20:27:45 [hhalpin]

ack hannes

20:27:50 [PHB]

Dan: this is going to be regulatory rather than legal if users being abused

20:27:53 [PHB]

Hannes

20:28:19 [PHB]

nobody knows waht trust framework means before that was federation etc.

20:28:32 [PHB]

NSTIC credit card model is mentioned

20:28:53 [PHB]

unfortunate direction because that model is not secure or

20:28:58 [PHB]

good

20:29:26 [PHB]

not sre where issues likel liabilities lie or whtheer wider community wants to use

20:29:49 [PHB]

Phil: id in browser is good should really be able to share it

20:29:59 [hhalpin]

ack a2

20:30:02 [PHB]

have family of 5 thousands of contacts

20:30:08 [PHB]

how can one member share with others?

20:30:42 [PHB]

thomas on the crexit card issue, agree not good model but not specific implementation but the way the issues are worked legally and contractually

20:30:57 [PHB]

provides one p[ossible model of how to bind users to one model with a regulatory overlay

20:31:17 [PHB]

Don thing that made credit card issue work in US was the last leg and limited exposure

20:34:10 [dpranke]

I will also note that the way payments work internationally, there is a lot of variance and cultural differences that may make a global ecosystem for

20:34:59 [dpranke]

Trust and identity much more difficult.

20:37:38 [Hadley]

Hadley has joined #idbrowser

20:45:16 [dpranke]

dpranke has joined #idbrowser

20:46:53 [nico]

nico has joined #idbrowser

20:50:15 [nico_]

nico_ has joined #idbrowser

20:50:19 [nico__]

nico__ has joined #idbrowser

21:06:45 [lowenthal]

lowenthal has joined #idbrowser

21:08:44 [lowenthal]

q?

21:11:02 [lowenthal]

ScribeNick: lowenthal

21:16:03 [tlr]

tlr has joined #idbrowser

21:16:29 [lowenthal]

starting: protocol & api proposals

21:16:37 [lowenthal]

moderator: halpin

21:17:15 [lowenthal]

video presentation in lieu of henry story

21:17:19 [bradhill]

bradhill has joined #idbrowser

21:17:31 [lowenthal]

paper topic "the webid protocol & browsers"

21:18:05 [lowenthal]

story video presentation will occur last

21:19:01 [CraigWi]

CraigWi has joined #idbrowser

21:19:14 [bblfish]

hi

21:19:16 [lowenthal]

talking: yutaka

21:19:17 [bblfish]

is this now?

21:19:29 [fjh]

fjh has joined #idbrowser

21:19:40 [jkmathes]

jkmathes has joined #IDBrowser

21:19:48 [benadida]

benadida has joined #idbrowser

21:20:01 [bblfish]

presentation available online at http://bblfish.net/blog/2011/05/25/

21:20:08 [lowenthal]

keywords: can't get there from here

21:20:15 [bhill2]

bhill2 has joined #idbrowser

21:20:18 [lowenthal]

..."phishing is fun & profitable"

21:20:31 [lowenthal]

problem: form auth insecure against forging

21:20:43 [lowenthal]

web pages control behaviour 100%

21:21:02 [lowenthal]

even if we could make a secure password field, phishers could forge it via js

21:21:17 [lowenthal]

http auth is only potentially better

21:21:36 [lowenthal]

currently sucks: both basic and digest are insecure

21:21:55 [lowenthal]

lacks feature: ugly dialog, no ux, customization

21:22:04 [lowenthal]

no logout, gues access, session management

21:22:12 [lowenthal]

little motivation to fix http auth

21:22:18 [lowenthal]

because not currently used

21:22:27 [lowenthal]

so no motivation to use http auth

21:22:34 [lowenthal]

... chicken & egg problem

21:22:45 [lowenthal]

but: we cannot fix form auth

21:22:55 [lowenthal]

we need to cut the gordian knots of this problem

21:23:06 [tantek]

tantek has joined #idbrowser

21:23:10 [lowenthal]

we need mechanisms to mitigate current problems

21:23:23 [lowenthal]

proposal: password-based http auth protocol

21:23:42 [lowenthal]

strongly protects against eavesdropping mitm, forwarding, offline attacks

21:23:54 [lowenthal]

mutual site/user identification

21:24:08 [lowenthal]

auth success iff correct site && correct password

21:24:20 [lowenthal]

with a phishing site, authentication fails

21:24:29 [lowenthal]

users can confirm that they are talking to correct sit

21:24:48 [lowenthal]

where correct means the same site the user made an account on (ie tofu)

21:24:59 [lowenthal]

that is: true, bidirectional shared secret

21:25:09 [lowenthal]

need to overcome 'usability' problem

21:25:20 [lowenthal]

by supporting current web app design

21:25:33 [lowenthal]

secure ui needed

21:25:44 [lowenthal]

[preventing password stealing by imitation]

21:25:55 [lowenthal]

mutual auth result should be available to the user

21:26:06 [lowenthal]

need 'non-modal' ui

21:26:16 [lowenthal]

ui in a non-content browser-controlled area

21:26:27 [lowenthal]

example: adjacent to address bar

21:26:44 [lowenthal]

but each browser can implement own ui, subject to requirements

21:26:57 [lowenthal]

coordination may be desirable

21:27:06 [lowenthal]

standardization desired

21:27:11 [lowenthal]

use cases:

21:27:26 [lowenthal]

standalone, for any website, like email

21:27:36 [lowenthal]

combine with id amangement like pw managers?

21:27:52 [lowenthal]

with federated logins, use http auth to sign into initial provider

21:28:19 [lowenthal]

currently proposing standardization in ietf

21:28:30 [lowenthal]

we should start standardizing, rolling out asap

21:28:45 [lowenthal]

one we reach major adoption, we may see a world with web auth

21:29:01 [lowenthal]

mailing list http-auth@ietf.org

21:29:27 [lowenthal]

talking nicolas williams

21:29:40 [lowenthal]

cryptonector lls, secureendpoints

21:29:56 [lowenthal]

proposing http auth system

21:30:02 [lowenthal]

http auth challenges

21:30:07 [lowenthal]

multiple infrastrustuces

21:30:15 [lowenthal]

preserve investment

21:30:30 [lowenthal]

need federation, authorization, granularity

21:30:43 [lowenthal]

need to define, protect session & associate w/session

21:30:54 [lowenthal]

need to supprt browser & non-browser http apps

21:31:06 [lowenthal]

need better ux: browser chrome, os integrations

21:31:11 [lowenthal]

constraints:

21:31:15 [lowenthal]

improve security

21:31:28 [lowenthal]

minimal/no mods to current software/hardware stack

21:31:44 [lowenthal]

nobody is going to rebuild / reconfigure current software stacks

21:31:51 [lowenthal]

apps must control when auth happens

21:32:02 [lowenthal]

may also wish to define mechanisms

21:32:13 [lowenthal]

... attributes, results

21:32:19 [lowenthal]

& apps want control over ui

21:32:25 [lowenthal]

certainly more than current http auth

21:32:33 [lowenthal]

proposal: REST-GSS

21:33:02 [lowenthal]

pluggable app-layer auth, supporting passwords, kerberos, pki, samil, openid, oauth... &c

21:33:07 [lowenthal]

entirely above http

21:33:17 [lowenthal]

auth done via post

21:33:45 [lowenthal]

post initial token to well-known uri, return 201, w/token, session uri

21:33:51 [lowenthal]

logout via delete

21:34:00 [lowenthal]

works at all http versions

21:34:17 [lowenthal]

sessions bound via 'mic' [like hmac]

21:34:22 [dpranke]

dpranke has joined #idbrowser

21:34:33 [lowenthal]

still possible to use cookies if web developers want

21:34:54 [JeffH]

ss-rest similar to draft-hammer-oauth-v2-mac-token-05

21:34:57 [lowenthal]

similar to msoft's integrated windows authentication

21:35:17 [lowenthal]

useful for enterprise applications

21:35:25 [lowenthal]

position paper focused on protocol

21:35:31 [lowenthal]

no for some ui & api elements

21:35:38 [lowenthal]

ui: dom element w/ login button

21:36:15 [lowenthal]

browser mechanism to indicate status, like https lock icon only indicating your identity, rather than server's

21:36:26 [lowenthal]

easy to switch between identities stored in browser

21:36:38 [lowenthal]

api:

21:36:50 [lowenthal]

xmlhttprequest bindings of the same thing

21:36:57 [lowenthal]

sometimes a script will want to trigger auth

21:37:04 [lowenthal]

similar for status enquiries

21:37:39 [lowenthal]

perhaps script will want to specify target name, (but we want something like same-origin restrictions to prevent credential hijacking)

21:37:59 [lowenthal]

server-side can be implement in cgi completely using current ots tech

21:38:07 [lowenthal]

doesn't need modification to http stack

21:38:21 [lowenthal]

but can be integrated to make things easy, and make ui modification

21:38:42 [lowenthal]

hopefully can train users not to enter passwords into web pages

21:38:52 [lowenthal]

making browser chrome non-spoofable is tricky

21:39:01 [lowenthal]

why rest-gss? alternatives?

21:39:04 [lowenthal]

pros:

21:39:13 [lowenthal]

many cots implementations of gss-api

21:39:25 [lowenthal]

mit, heimdal, windows &c

21:39:40 [lowenthal]

oauth, openid now support one-way id

21:39:43 [mixedpuppy]

mixedpuppy has joined #idbrowser

21:39:45 [lowenthal]

os integration

21:39:48 [lowenthal]

pluggable

21:40:01 [lowenthal]

need a new mechanism like 0-know passwd proofs? add it!

21:40:08 [bhill2]

q+

21:40:08 [lowenthal]

auth at the correct layer

21:40:31 [lowenthal]

makes ssl less of a point of failure

21:40:42 [lowenthal]

alternatives: same with sasle?

21:40:46 [lowenthal]

something new?

21:40:59 [lowenthal]

use tls better? where do we get client certs?

21:41:17 [lowenthal]

api primer, message flow slides skipped

21:41:25 [lowenthal]

slides have notes, will be available online

21:41:33 [lowenthal]

one last thing:

21:41:34 [tlr]

tlr has joined #idbrowser

21:41:38 [lowenthal]

abstraction is key

21:41:51 [lowenthal]

much talk of single-frameworks using single mechanism

21:42:02 [lowenthal]

here can add/switch mechanisms as you like it

21:42:07 [lowenthal]

w/o code changes

21:42:14 [lowenthal]

q?

21:42:48 [lowenthal]

now talking biran

21:42:58 [lowenthal]

backplane protocol in id scenario

21:43:17 [lowenthal]

problem: site composed of widgets coming from different servers

21:43:27 [lowenthal]

each widget has its own notion of user auth

21:43:37 [lowenthal]

widgets want to know about auth to each other

21:43:58 [lowenthal]

<illustration indicating widgets on lady gaga site>

21:44:05 [lowenthal]

widgets want to know who's logged in

21:44:17 [lowenthal]

ux: don't want users to have to login to each widget

21:44:22 [lowenthal]

now talking vlad:

21:45:02 [lowenthal]

when a user logs into a widget, authorizing server notifies backplane server, which notifies other widgets which want to know about it

21:45:19 [lowenthal]

backplane is a method for sharing messages between server-side applications & widgets

21:45:31 [lowenthal]

want to convey info between widgets & server-side components

21:45:46 [lowenthal]

<example backplane message>

21:46:03 [lowenthal]

have defined a js api for widgets to collaborate

21:46:15 [lowenthal]

differences in security settings of different clients that use backplane

21:46:24 [lowenthal]

design reflects this difference

21:46:33 [lowenthal]

widgets cannot post to backplane, only listen

21:46:47 [lowenthal]

only get partial information, so that sensitive information will not be exposed

21:47:00 [lowenthal]

widgets only get info tied to a browser session

21:47:13 [lowenthal]

backplane v1 has been develped ~1yr, used by wapo, espn

21:47:20 [lowenthal]

see backplanespec.com

21:47:46 [lowenthal]

now talking jeff hodges

21:48:05 [lowenthal]

on behlaf of ietf sec area & apps directors

21:48:10 [lowenthal]

crypto apis

21:48:26 [lowenthal]

web pages sometimes want to do crypto operations

21:48:40 [lowenthal]

sign, verify, encrypt, decrypt &c

21:49:10 [lowenthal]

how do pages do crypto on client-side?

21:49:25 [lowenthal]

currently: everyone writes their own crypto primitives in js

21:50:02 [lowenthal]

is it good for web pages to dynamically, insecurely embed crypto implementations

21:50:15 [lowenthal]

[no]

21:50:28 [lowenthal]

currently pages xss their aes

21:50:30 [lowenthal]

=[

21:50:45 [lowenthal]

may good implementations to choose from

21:50:58 [lowenthal]

*many...

21:51:46 [lowenthal]

position: we should not do this, we should have a js crypto aip, built on browser/os libraries

21:51:54 [benadida]

q+

21:52:00 [lowenthal]

we currently have implicit agreement

21:52:18 [lowenthal]

so: who do wee need to do it, and which standards body is desireable?

21:53:06 [lowenthal]

many threads at w3, ietf talking about need for this

21:53:29 [lowenthal]

so, lets use existing crypto, rather than recoding & introducing bugs

21:53:38 [dpranke]

Q+

21:53:44 [lowenthal]

now: henry story video presentation, from apache

21:54:02 [bblfish]

video online here for those following remotely http://bblfish.net/blog/2011/05/25/

21:54:08 [bblfish]

(with bonus)

21:54:11 [lowenthal]

how webid works in existing browsers

21:54:29 [lowenthal]

net is a distributed network in a distributed namespace

21:54:35 [nico]

nico has joined #idbrowser

21:54:36 [lowenthal]

<birdsong in background>

21:54:52 [bblfish]

:-) yes there's a forest here in Fontainebleau

21:54:55 [lowenthal]

we can use hashtag urls to identify users

21:55:18 [lowenthal]

demo: viewing profiles

21:55:38 [lowenthal]

example: webid listed via hashtag uri

21:55:51 [lowenthal]

clig, get profile, add as contact

21:56:09 [lowenthal]

if we have many friends, privacy issue

21:56:26 [lowenthal]

ideally, individuals should be able to secure pii

21:56:37 [lowenthal]

webid protocol attempts to solve this

21:56:44 [lowenthal]

built on tls, x509

21:56:47 [lowenthal]

what's new?

21:57:18 [lowenthal]

instead of authenticating server relying on ca to auth bob, gets info from bob's profile url

21:57:37 [lowenthal]

creating a cert/public-key from a user's homepage

21:57:55 [lowenthal]

browser makes keypair, sends pub part to server

21:58:34 [lowenthal]

what can we do with a webid

21:58:38 [lowenthal]

use on a new service

21:58:46 [lowenthal]

authenticate by selecting a client certificate

21:58:54 [lowenthal]

log in using this cert

21:59:10 [lowenthal]

server gets name, picture &c...

21:59:11 [lowenthal]

q+

21:59:18 [lowenthal]

what happend during login?

21:59:33 [lowenthal]

login button pointed to https endpoint

21:59:39 [nico]

nico has joined #idbrowser

21:59:39 [lowenthal]

server requests client cert

21:59:49 [lowenthal]

browser allows uder to pic client cert

22:00:05 [lowenthal]

browser can show this different way

22:00:17 [lowenthal]

firefox sucks, iphone rocks at this ux

22:00:25 [lowenthal]

server verifies keys

22:00:32 [lowenthal]

server derefs url

22:00:57 [lowenthal]

now server confirms that key on cert is same as key on remote profile

22:01:23 [lowenthal]

now cert knows that user is same as profile creator

22:01:57 [lowenthal]

this is a very limited form of authentication

22:02:10 [lowenthal]

not a lot of proof offered

22:02:23 [lowenthal]

webid uses existing tech to create a referential web of trust

22:02:45 [bblfish]

(there are a lot of papers listed at http://www.w3.org/wiki/Foaf%2Bssl

22:02:49 [lowenthal]

no need to place attributes in cert: placed in client profile page, limited by access

22:03:16 [lowenthal]

this should look like the mozilla prototype from aza raskin

22:03:48 [lowenthal]

want os vendors to support crypto usb keys like gpf cryptokey

22:03:56 [lowenthal]

webid.info/spec

22:03:56 [bblfish]

the demo is the second video on http://bblfish.net/blog/2011/05/25/

22:04:20 [bblfish]

you can call me on skype bblfish or us number +1 (510) 931-5491

22:04:27 [lowenthal]

now moving to general discussion

22:05:03 [lowenthal]

fred hirsh: html5 & web notifications: is that relevant to you, esp re ntofications?

22:05:08 [lowenthal]

vlad: no, not directly

22:05:49 [lowenthal]

q?

22:06:40 [nico]

nico has joined #idbrowser

22:06:41 [lowenthal]

brad hill, re gss rest, missing some details. how do we identify the target, needs to be done a priori by client, other side of mutual auth missing

22:07:02 [lowenthal]

answer: does not rely on target

22:07:15 [lowenthal]

ex oauth doesn't do that, still needs tls to auth

22:07:29 [lowenthal]

kerberos/pki can cope with that

22:07:35 [lowenthal]

q- bhill

22:07:42 [dveditz]

dveditz has joined #idbrowser

22:08:23 [bblfish]

answer to twitter: #WebID is nothing new. It just does what TLS was designed to do from the start- we just use URIs instead of distinguished names (@shingou was saying "why invent something new"?)

22:08:28 [JeffH]

sam hartman interjecting

22:08:45 [lowenthal]

if no security indicators in chrome... web apps should have same auth powers as native apps

22:09:08 [lowenthal]

starting from trusted https, have guarantees, if not, fewer guarantees

22:09:35 [lowenthal]

perhaps you could sue these sorts of signals to create an indicator (whether or not anyone would look at it)

22:10:17 [lowenthal]

williams: don't want sites to be able to hijack credentials... except when we do

22:10:33 [lowenthal]

adida:

22:10:39 [tyler]

tyler has joined #idbrowser

22:10:55 [mark]

mark has joined #idbrowser

22:11:06 [tyler]

q

22:11:12 [tyler]

q+

22:11:19 [mark]

q+

22:11:31 [lowenthal]

q about crypto api. risk of over-specification. important to be flexible enough to cover all use cases

22:11:45 [lowenthal]

focus on minimum spec that covers maximum spread of case

22:11:57 [lowenthal]

let's use apis for algos, rather than process

22:12:08 [lowenthal]

hodges: food for though for standardization effors

22:12:58 [lowenthal]

another q: this has happened before. is this a browser-specific problem or should js just have a crypto lib in general?

22:13:50 [bblfish]

me +1 for crypto lib. A lot of people would like to use crypto libs to access keys in keychain. It would be best if those keys were protected by the chrome.

22:13:51 [lowenthal]

hodges:punt to brian. interesting question. happened on lists before. mark miller, brendon suggest workgroup to make in-lang crypto, still not sure if it's a good idea.

22:14:26 [lowenthal]

brian: ui integration make/manage keypairs is critical, and good reason to do it browserwise rather than language-wise

22:14:36 [lowenthal]

that's assuming we have crypto primitives

22:15:03 [lowenthal]

williams: pkcs11 is lousy for a crypto api, but does work well for key storage

22:15:15 [lowenthal]

we should bake in crypto apis

22:15:20 [lowenthal]

[raw crypto]

22:15:31 [lowenthal]

but also want pkcs11 so that we can use hardware tokens

22:15:42 [lowenthal]

we risk loosing browser integration

22:15:53 [lowenthal]

if we don't have a browser implementation, people will make it anyway

22:16:19 [lowenthal]

another answer: apis will happen, only open question is how. going to be decided by es-discuss

22:16:50 [lowenthal]

if only we had existing, running code that we can reimplement

22:17:17 [lowenthal]

agree: there are certain classes of operations folks want for specific applications

22:17:19 [bblfish]

hardware tokens would be very nice. The second demo on that page shows already how far one can go with them http://bblfish.net/blog/2011/05/25/

22:17:29 [bblfish]

but hardware tokens need better browser integration

22:17:34 [lowenthal]

williams: eg hashes, c-lib objects

22:17:59 [lowenthal]

david speaking for henry

22:18:09 [lowenthal]

greg to willaims

22:18:10 [bblfish]

currently from the 2nd video on that slide, it is clear that one has to download drivers to get browser to work with crypto key

22:18:22 [tyler]

Zakim, who is on the q

22:18:22 [Zakim]

I don't understand 'who is on the q', tyler

22:18:24 [lowenthal]

how will mechanisms be distributed into this api?

22:18:45 [nico]

nico has joined #idbrowser

22:18:57 [lowenthal]

williams: ex windows, solaris, &c, apps use gss-api portably, agnostic to mechanism as long as mechanism has the correct properties

22:19:02 [lowenthal]

q?

22:19:08 [lowenthal]

q- benadida

22:19:17 [lowenthal]

q- dpranke

22:19:22 [lowenthal]

q- lowenthal

22:19:41 [lowenthal]

we should be able to do it purely in js?

22:19:47 [lowenthal]

but then we'd loose browser integration

22:19:54 [bblfish]

q+

22:20:35 [lowenthal]

q- tyler

22:21:08 [lowenthal]

q: what gui should one show a user for sensitive functions like signing, key operations

22:21:26 [lowenthal]

hodges: not necc. depends on use case

22:21:45 [lowenthal]

specifically: depends who provides the key

22:21:57 [bhill2]

q+

22:21:58 [tyler]

q+

22:22:20 [tyler]

lowenthal, why did you remove me from the q?

22:23:17 [lowenthal]

trick is to create a simple api which covers most use cases,: sign, encrypt, decrypt, verify, tls

22:23:46 [lowenthal]

to do this, need access to crypto pimitives, under hood

22:24:02 [lowenthal]

dirk: can i be logged into two accounts

22:24:09 [lowenthal]

dave: yes,

22:24:30 [lowenthal]

pick certs (&ids) case-by-case

22:24:51 [lowenthal]

dirk: multi-login, a la google!

22:25:18 [lowenthal]

dave: not sure

22:25:37 [lowenthal]

williams: gss-rest, use session id interchangably

22:25:44 [lowenthal]

different tabs

22:26:39 [hhalpin]

hhalpin has joined #idbrowser

22:26:53 [hhalpin]

anyone scribing?

22:26:59 [lowenthal]

see google documentation to conclude

22:27:07 [lowenthal]

behavior complex, dynamic

22:27:21 [lowenthal]

dirk: sensible for gss, up to server to identify

22:27:33 [lowenthal]

dave: use two identities for one request

22:28:06 [bblfish]

I am just thinking of the time going by, and all the discussion is on Javascript. But much more important in my view is to allow the end user to see WHO he is logged in as. Users need immediate feedback to their idenitty. If a user does not know who he is, if he cannot physically in a gesture control his idenitty, then he cannot feel in control. If he does not feel in control he will feel alienated, and you will have a lot of trouble and a lot of resistanc

22:28:07 [bblfish]

So I put the work of Aza Raskin as the top priority. A user has to be able to control at least sometimes what he is also by being able to publish information about himself, and control who (at least initially) sees it. So here is a pointer to Aza's initial article http://www.azarask.in/blog/post/identity-in-the-browser-firefox/

22:28:17 [mark]

q?

22:28:18 [Deiu]

Deiu has joined #idbrowser

22:28:27 [dpranke]

q+

22:28:40 [lowenthal]

tyler: what about offline scenarios using post to iframes so that it works offline

22:28:47 [lowenthal]

williams: have not thought about offline

22:28:49 [nico]

nico has joined #idbrowser

22:28:51 [hhalpin]

q?

22:29:02 [lowenthal]

same-origin restriction applying

22:29:18 [lowenthal]

backplane works that way too

22:29:21 [lowenthal]

unusual use-case

22:29:29 [jimklo]

jimklo has joined #idbrowser

22:29:46 [lowenthal]

brian: signing is sensitive. need to think about it carefully, and no delegate arbitrarily

22:30:23 [lowenthal]

important concern, in fact more important than api in general

22:30:51 [lowenthal]

williams: not a new problem. if script wants to use its own key. but if script want to use user's key, then we need to worry

22:31:51 [hhalpin]

q?

22:32:08 [lowenthal]

brian: may need to build them on-top of browser-only

22:32:14 [lowenthal]

bblfish, your q?

22:32:18 [lowenthal]

anything further?

22:32:20 [bblfish]

It's above

22:32:24 [bhill2]

When it's my time in the queue (for bblfish): for webID, what possible chance of adoption is there for intra-handshake, user-supplied call-outs by servers and termination appliances given the attack surface, resource and performance cost, and denial-of-service risks that introduces? isn't this a impossible to surmount deployment blocker? also- how to relay that information from a termination appliance down to the webapp?

22:33:11 [lowenthal]

q: protected key store, or script doing arbitrary operations?

22:33:23 [lowenthal]

hodges: both! presentation high-level

22:34:36 [lowenthal]

siddarth: have talked about webid, certs &c. esp when using ssl client auth, client has very little control about session. if wrong cert selected, only option is to close browser, which sucks. something to think about for standardization

22:34:46 [lowenthal]

bblfish, any response to bhill2?

22:34:56 [bblfish]

denial of serivce attacks could be reduced to the minimum if it were possible for the server to be on the client. For then the whole internet could be down: if you can connect to the server then it can connect to you. So I think one needs ipv6 for that. In any case WebID inherits all of the goodness of the web such as caching. It also

22:35:08 [lowenthal]

siddarth: important to give applications more control

22:35:17 [bblfish]

is possible to have more than one WebID in Subject Alternative Name of X509

22:35:24 [bblfish]

we are playing with that at the Webid XG

22:35:25 [lowenthal]

<redacted>

22:35:58 [bblfish]

finally you can have trusted proxies you could ask for their version of the facts

22:36:08 [lowenthal]

bhill: derefing a url mid-handshake is crazy-talk

22:36:13 [bblfish]

but I think it's best to start simple

22:36:23 [benadida]

benadida has joined #idbrowser

22:36:23 [bblfish]

it works :-)

22:36:44 [bblfish]

you only have to derfer first time bhill

22:36:49 [bblfish]

then you have a cache

22:36:53 [bblfish]

lookup

22:37:07 [lowenthal]

dave: need to have browser make certs

22:37:26 [lowenthal]

but still need the validation to confirm that current user is same as url owner

22:37:31 [bblfish]

it is just as easy to have your freedom box make a cert for you

22:37:50 [lowenthal]

bhill: that sounds challenging

22:37:58 [lowenthal]

dave: can do crypto confirmation

22:38:09 [bblfish]

why? Does Google validate that you are the same person as the password knower each time?

22:38:13 [lowenthal]

fetching web-page is crucial to do verification

22:38:26 [bblfish]

in any case TLS already has to do that

22:38:31 [lowenthal]

bhill: fetching a webpage is a risk

22:38:43 [lowenthal]

dave, jh, dos is risk

22:38:43 [bblfish]

it has to if it is serious do a connection to veriffy certificate is not on BAD cert list

22:39:00 [bblfish]

dos is less risk because it is distributed

22:39:07 [bblfish]

everyone can have their own box

22:39:12 [bblfish]

so no center to attack

22:39:21 [bhill2]

tls already has to fetch a webpage to verify a cert?

22:39:30 [bhill2]

1st: most sited don't accept client certs at all

22:39:39 [lowenthal]

hannes: re backplane. mixed-content. let indie js widgets chat?

22:39:44 [bhill2]

so AIA, OCSP, etc for client auth is not a current issue

22:39:50 [tlr]

Most slides are now linked from the agenda: http://www.w3.org/2011/identity-ws/agenda.html

22:39:51 [lowenthal]

vlad: actually, widgets only listen, not talk

22:39:58 [bblfish]

revocation of keys works simply by deleting key from your home page . Clerezza has a delte button for that

22:40:20 [bblfish]

tls should verifiy that cer is not revoked

22:40:25 [lowenthal]

hannes: doesn't this risk breaking the same-origin policy?

22:40:29 [bhill2]

second, if those do exist and need to be fetched, they are supplied by the authorities in a limited set of trust roots, not by the user

22:40:44 [lowenthal]

vlad: yes, a risk of giving sensitive info to widgets

22:40:45 [bhill2]

it's an entirely different risk picture for a server that wants to start accepting auth

22:40:49 [bblfish]

most sites don't accept client certs because of ONE reason. It make no sense without WebID

22:40:53 [lowenthal]

prior config needs to take place

22:40:54 [bhill2]

from a distributed trust infrastructure

22:41:04 [lowenthal]

widgets need message payload

22:41:10 [bblfish]

because most client certs for something other than then army only works for one company

22:41:24 [lowenthal]

hannes: openid &c user chooses what gets shared. doesn't this violate that principle?

22:41:28 [bblfish]

for client certs to make sense in consumer space: they have to work globally on every server

22:41:35 [bhill2]

*most* sites don't even deploy anonymous TLS for server auth because of the cost

22:41:42 [bhill2]

webId makes that dramatically worse

22:41:46 [bblfish]

yes, cost is high

22:42:00 [bblfish]

DANE and DNS-sec is going to make it possible to have self signed server certs

22:42:05 [lowenthal]

vlad: actually owners get control of info/signaling

22:42:09 [bblfish]

and so mass deployment of TLS

22:42:14 [lowenthal]

hannes: that is dangerous

22:42:23 [lowenthal]

mod: you two should fight outside

22:42:28 [bblfish]

:-)

22:42:32 [lowenthal]

mod:

22:42:51 [lowenthal]

backplane: is it being standardized in an open body

22:43:03 [lowenthal]

answer: not currently being standardized, wants to be

22:43:15 [bblfish]

I should have just pointed at the FAQ. Most of those questions are listed there sorry http://www.w3.org/wiki/Foaf%2Bssl/FAQ

22:43:16 [lowenthal]

webid is currently a w3c incubator project

22:43:38 [lowenthal]

tlr: incubators will be replaced soon

22:44:25 [lowenthal]

websec api does not yet have a standards body or a list

22:44:58 [lowenthal]

hodges will now create a mailing list for crypto apis, possibly at ietf

22:46:29 [vaibhav]

vaibhav has joined #idbrowser

22:46:32 [lowenthal]

gss-rest is not currently in a standards track [gss track of ietf?] if interested, could find a place for it at ietf

22:46:35 [lowenthal]

who is interested?

22:47:06 [lowenthal]

ex dom elements might need to be at w3c

22:47:24 [lowenthal]

protocol could be ietf, but might as well be w3c

22:47:37 [lowenthal]

adjourn

22:49:15 [bblfish]

btw, as I mentioned if people wish to talk around a virtual coffee feel free to skype me on bblfish

22:49:25 [bblfish]

or call +1 (510) 931-5491

22:49:41 [bblfish]

Sorry could not be in the US

22:52:01 [bblfish]

multi id over single session? Clerezza has implemented that btw

22:52:13 [bblfish]

You can login with password + WebID together

23:11:39 [tantek]

tantek has joined #idbrowser

23:13:37 [bhill2]

bhill2 has joined #idbrowser

23:14:11 [mark]

mark has joined #idbrowser

23:15:48 [hhalpin]

tantek: id markup for forms

23:16:03 [hhalpin]

... <input type="identity-url"

23:16:14 [hhalpin]

type=password, pwtype="sign-in"

23:16:31 [HAYASHI]

HAYASHI has joined #idbrowser

23:16:40 [hhalpin]

pwtype = "sign-in|create|confirm"

23:16:43 [hhalpin]

dittosingup

23:16:56 [hhalpin]

straw proposal

23:17:27 [hhalpin]

<input type="checkbox" rememberme>

23:20:07 [bhill2]

scribenick bhill2

23:20:08 [fjh]

fjh has joined #idbrowser

23:20:32 [bhill2]

discussion on whether confirm password should be autofilled

23:20:46 [bhill2]

should browser do this, or is this necessary user-interaction confirmation

23:21:40 [bhill2]

scribe: bhill2

23:21:51 [bhill2]

ScribeNick: bhill2

23:22:09 [bhill2]

<a little help, people?>

23:22:23 [hhalpin]

fallback to normal url

23:22:30 [hhalpin]

and normal type "email"

23:22:33 [hhalpin]

for both inputs

23:22:36 [tantek]

perhaps consider using role="identity"

23:22:36 [tlr]

tlr: <input type="url" identty>

23:22:40 [tlr]

tlr: <input type="url" identity>

23:22:41 [tlr]

or role

23:22:43 [tlr]

something like that

23:22:59 [hhalpin]

lowenthal: the incentives for using the type and representing the type are not aligned

23:23:27 [bhill2]

dpranke: give banks, etc. an option to force re-authentication to browser pwd manager

23:23:33 [bhill2]

instead of disabling autofill

23:23:35 [hhalpin]

dirk: banks refuse to use auto-complete because they do not have a client smart enough to check

23:24:25 [tantek]

input type="identity-username"

23:24:30 [tantek]

idtype similar to role

23:24:35 [mixedpuppy]

mixedpuppy has joined #idbrowser

23:24:39 [bhill2]

stevemitchell: add additional types, smartcard, etc.

23:25:39 [bhill2]

who?: linkage of cookies to be created as a result of signin

23:25:53 [bhill2]

greg: but advertisers will just do that, not a t rustworthy semantic

23:26:24 [hober]

role="" is inappropriate for this; role="" is for WAI-ARIA annotations and not a generic "attach additional semantics to this element" attribute

23:26:44 [bhill2]

dave crocker: what layer to model this at - may happen at different protocols, versions?

23:27:18 [bhill2]

tantek: specifically proposal to address at level of html form annotations, taxonomy is based strictly on existing examples

23:27:51 [bhill2]

dcrocker: how to mature this idea into new and improved protocols, specify protocols and details

23:28:22 [bhill2]

dan: make even more abstract, include ability to trigger, e.g. phone OTP

23:28:53 [bhill2]

dpranke: rules for password requirements in annotations, better than existing pattern regex indications

23:29:19 [JeffH]

a nerd's perspective on some problem: "just create the right regex? eh?"

23:29:21 [tantek]

a way for the site to communicate its password requirements (length, special characters, etc.)

23:29:51 [bhill2]

dpranke: rfc 3106, supplanted by 4112, ecml alliance has vanished years ago, no need to conform to that

23:29:55 [benadida]

benadida has joined #idbrowser

23:30:09 [bhill2]

tlr: draft has 20 pages

23:31:23 [bhill2]

tantek: user still has control over "remember me" box, just option to delegate preferences to browser

23:32:34 [bhill2]

new speaker: tyler close, google

23:33:36 [bhill2]

topic: web introducer

23:33:46 [tantek]

thanks everyone - great suggestions

23:34:01 [bhill2]

many existing identity systems, based on existing browser tech

23:34:11 [bhill2]

what tiny chagnes could we make to allow new systems to evolve?

23:34:13 [hober]

You can communicate password requirements with the form constraint validation API: http://www.whatwg.org/specs/web-apps/current-work/complete/association-of-controls-and-forms.html#the-constraint-validation-api

23:34:19 [dpranke]

Ecml appears to have been largely about ecommerce, wallets, (Billing address, card number) etc.

23:34:51 [bhill2]

e.g. nascar problem for openID, and full window page transitions for redirects to IdP

23:35:20 [bhill2]

two problems; how does RP discover IdPs, how does IdP get consent from user?

23:35:51 [bhill2]

demo: small API to do these two things

23:36:12 [tantek]

my slides btw: http://tantek.com/presentations/2011/05/idinputs/

23:36:14 [dpranke]

@hober : last I looked that API didn't work for me.

23:36:37 [hhalpin]

http://web-send.org/introducer/

23:36:42 [hhalpin]

the draft spec

23:36:58 [bhill2]

example bookmark sharing service. clicking shows a list from the user agent showing what social bookmarking services the user has configured

23:36:59 [hhalpin]

http://web-send.org/bookmark/

23:37:04 [hhalpin]

the bookmarking example

23:37:35 [bhill2]

UI is from user agent, choices not shared with server, UI is clickjacking resistant (so IdP gets reliable confirmation of user intent)

23:37:41 [dpranke]

dpranke has joined #idbrowser

23:37:51 [bhill2]

browser pops iframe for completion of the action

23:38:16 [bhill2]

nascar is avoided by browser presentation: can be aware of context-sensitive valid choices

23:39:20 [bhill2]

same idea works for lightweight version of openid-like protocol to deliver email address attestation

23:39:39 [bhill2]

could be a variety of types, vcards, calendar entries...

23:40:20 [bhill2]

new feature in browser: browser services in a gold bar

23:40:34 [bhill2]

allow services to be registered in browser

23:41:10 [bhill2]

new options show up in the browser-presented bookmark sharing service choices after simple opt-in

23:41:34 [bhill2]

no need to rely on site to have your service button (reddit, digg, etc..)

23:42:06 [bhill2]

anyone can hook into this API and get 100% coverage of all offerings of that type on the web

23:42:15 [bhill2]

question: failover?

23:42:28 [bhill2]

implemented in firefox using only javascript

23:42:50 [bhill2]

unmodified firefox demo

23:43:05 [bhill2]

opens transparent iframe to trusted site and uses clickjacking to get dropdown

23:43:41 [bhill2]

if using <select> is implemented by OS, at highest z order so no clickjacking

23:44:13 [bhill2]

question: mike perry: are there other side channels for sites to extract this information from the user?

23:44:26 [bhill2]

web-send.org/features.html has a list of features

23:44:36 [bhill2]

question is about "preference privacy"

23:44:59 [bhill2]

dpranke: lots of debate if this is a good thing or not - many publishers won't deploy unless they can get the list

23:45:18 [bhill2]

protocol def should enable preference privacy, allow services to voluntarily disclose their presence

23:45:37 [bhill2]

http://web-send.org/

23:45:59 [bhill2]

trent: end of on-the-fly turbotalks

23:46:47 [mixedpuppy]

mixedpuppy has joined #idbrowser

23:46:47 [bhill2]

new topic and speaker: hhalpin for moving foward, strategy and tactics

23:46:58 [nico]

nico has joined #idbrowser

23:47:38 [bhill2]

browser makers to the front of the room please

23:47:50 [bhill2]

discussion: what are people actually interested in shipping?

23:48:58 [bhill2]

hhalpin: quick overview of w3c process, =JeffH to summarize IETF process

23:49:14 [bhill2]

Workshop->public-identity@w3.org

23:49:20 [bhill2]

public-identity-request@w3.org

23:51:32 [tlr]

subject: "subscribe"

23:52:02 [bhill2]

Report -> Workshop later | Not the time / punt | Community Track | Charter, working group, eventual w3c recommendation

23:52:57 [bhill2]

nico: question, post report track, can different ideas live in different tracks?

23:53:00 [bhill2]

yes

23:53:28 [bhill2]

other option: send to IETF or other body

23:53:36 [bhill2]

new speaker = jeffh to represent IETF process

23:54:29 [bhill2]

IETF starts with discussion (optionally), leads to mailing list (optional), leads to BoF at IETF meeting after some administrative process

23:55:43 [bhill2]

formal BoF may lead to, drop topic | a second BoF | formal Working Group | punt to IRTF for more research | goto 10

23:56:23 [bhill2]

sometimes RFC may happen with no working group with area director sponsorship

23:57:07 [bhill2]

nico: another option is to recharter an existing WG

23:59:25 [bhill2]

hhalpin back as presenter

23:59:44 [bhill2]

informal votes on what is worth pursuing plus feedback on browser folks on what might get done

23:59:57 [bhill2]

the list is: