Meeting minutes
Minutes Review
<kaz> May-9
There are a couple of spelling issues, which are fixed by kaz
Minutes are accepted
Architecture Security and Privacy Considerations
https://
PR 747
<kaz> PR 747 - Additional Security/Privacy Considerations around TLS, access controls for PII
mm: The PR 747 in the architecture repository has been merged
… there was some feedback before the merge
… let's look at the current draft and see it in context
… I added a section "Secure Transport", which we discussed last time
… I will go over the section again
… let me create an issue to capture some thoughts
… (starts adding a new issue)
… reference for TLS would be good as well as mentioning DTLS
… should an explicit version number be mentioned? Or just "up-to-date"?
… (adds comment that others should add missing points if they see any)
<McCool> https://
Discovery Explainer Draft
<kaz> PR 309 - Clean up new TLS S&P Considerations
mm: Started a PR for a Discovery explainer text
… I am mentioning this here because there are a lot of security related aspects in discovery
… added use-cases and requirements
… there is a paragraph on security, where I mention the TLS issue, access controls, and difficulties with LANs
… I also mention best-effort security
<McCool> https://
jr: Is the PR ready for review yet?
mm: (Adds a comment regarding the use of discovery in implementations)
ID requirements
mm: We discussed what the requirements for IDs are
… these are not completely done yet
<McCool> https://
mm: TD issue #1497 has come up for example
… IDs are optional, so my short term advice would be to not use IDs
… as TDDs assign temporary IDs for example
… we should probably consider use cases here
… interesting approach by Ben Francis mentioned in the issue, including the base URL in the ID, which might not necessarily be the best idea, though
… another relevant issue is TD issue #1490
https://
… (adds a comment regarding updated S&P considerations in the architecture document)
… the issue is not about IDs per se, though
… a new issue regarding IDs is TD issue #1503
… the example given here does not use opaque IDs, however
<McCool> https://
<McCool> https://
jr: Maybe we could a privacy label to group ID related (and other) issues
mm: Could be a good idea
mm: Regarding the privacy issue: Rotating IDs might not be enough
mm: We currently have a section on immutable identifiers in the document
… we could add another assertion that IDs must be altered when a thing is being transferred to another owner
… IDs could also be fetched instead of being exposed in a TD, if legally permitted
… in the ID metadata section, we could explicitly recommend UUID v4
… in the Globally Unique Idenfiers section, we mention UUIDs again
… let me capture some thoughts in an issue
… (adds comment to TD issue #1497)
… an example for use cases might be a keyfob which allows identification of an individual person and their location
jr: Another use case could be the exposure of Things and their TDs on the internet
… allowing for tracking if IDs are included
mm: Difference is that Things are analogous to web sites not browsers
… IDs on a thing do not lead to the browser being able to be tracked
… access from a browser could lead to tracking if IDs are saved in unsecure cookies
Comment is marked as WIP as there might be additional aspects that require discussion
MUD and WoT alignment
jr: added an example to an existing issue regarding MUD (Manufacturer Usage Description) and WoT alignment
https://
mm: Discussed this with Michael Lagally before, makes things more complex as client behavior needs to be considered, should be discussed for the next charter
… (adds the "DEFERRED" label to the issue)
[adjourned]