OpenId Foundation Activities - Revision history

Antoniok at 20:00, 28 April 2020

2020-04-28T20:00:23Z

← Older revision		Revision as of 22:00, 28 April 2020
Line 46:		Line 46:
	\|-		\|-
	\| Chair		\| Chair
	\| ~~<br/>~~		\|
			Annabelle Richard (Amazon), Atul Tulshibagwale (Google), Marius Scurtescu (Coinbase)

	\|-		\|-
	\| Overview		\| Overview
Line 58:		Line 60:
	\|-		\|-
	\| Web pages		\| Web pages
	\| [~~http~~://openid.net/wg/~~risc~~/ ~~http~~://openid.net/wg/~~risc~~/]		\| [https://openid.net/wg/sse/ https://openid.net/wg/sse/]
	\|-		\|-
	\| Documentation		\| Documentation

Antoniok at 19:59, 28 April 2020

2020-04-28T19:59:28Z

← Older revision		Revision as of 21:59, 28 April 2020
Line 41:		Line 41:
	\|}		\|}

	=== <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">~~Risc ~~WG</span> ===		=== <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">Shared Signals and Events WG</span> ===

	{\| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"		{\| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"
Line 50:		Line 50:
	\| Overview		\| Overview
	\|		\|
	The goal of ~~RISC~~ is to ~~provide data~~ sharing ~~schemas~~, ~~privacy recommendations~~ and ~~protocols~~ to:		The goal of the Shared Signals and Events Working Group is to enable the sharing of security events, state changes, and other signals between related and/or dependent systems in order to:

	*Share information about important security events in ~~order to thwart attackers~~ from leveraging ~~compromised~~ accounts ~~from one Service Provider~~ to gain access to ~~accounts on other Service Providers (mobile~~ or ~~web application developers and owners)~~.		# Manage access to resources and enforce access control restrictions across distributed services operating in a dynamic environment.
	*Enable users and providers to coordinate in order to ~~securely restore accounts following a compromise.~~		#Prevent malicious actors from leveraging compromises of accounts, devices, services, endpoints, or other principals or resources to gain unauthorized access to additional systems or resources.
			#Enable users, administrators, and service providers to coordinate in order to detect and respond to incidents.
	~~Internet accounts that use email addresses or phone numbers as the primary identifier for the account will be the initial focus.~~

	~~The working group is currently gathering the requirements~~ and ~~fit and gaps. One of the topics that the WG appreciate is the privacy aspect of the sharing of the account data.<br/>In essence, the specification will be describing how~~ to notify the relevant parties when higher account compromise risk were observed. For example, an email provider may provide that the email account now has elevated risk state that the service provider that uses the address as the account reset address may stop using it for the time being. This will prevent the account compromise chain among the service providers and will help maintain the user’s privacy.<br/>If the relationship between the email provider above and the service provider is explicit and the user has opted in, then it should not be a problem. However, in most cases, they are implicit. It is conceivable to guide the user to opt-in to this kind of relationship at the next login, but the people who did not opted in will not be protected. If the opt-out was allowed, the first thing the attacker would do after compromising the account is to opt-out from the account risk information sharing so that he can take over the related accounts as well. From our evaluation, one of the best way is for the service provider to share the password reset etc. email address with the email provider in bulk and set up the information sharing path without opt-out option. This will give the greatest privacy protection / privacy risk ratio.

	\|-		\|-

Antoniok: Undo revision 1368 by Antoniok (talk)

2020-04-28T19:58:06Z

Undo revision 1368 by Antoniok (talk)

@@ Line 41: / Line 41: @@
 |}
 === <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">Risc&nbsp;WG</span> ===
@@ Line 54: / Line 49: @@
 |-
 | Overview
+|
 |}

Antoniok at 19:57, 28 April 2020

2020-04-28T19:57:41Z

@@ Line 41: / Line 41: @@
 |}
 === <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">Risc&nbsp;WG</span> ===
@@ Line 49: / Line 54: @@
 |-
 | Overview
+|
 |}

Antoniok: Undo revision 1366 by Antoniok (talk)

2020-04-28T19:56:54Z

Undo revision 1366 by Antoniok (talk)

@@ Line 41: / Line 41: @@
 |}
-<parsererror style="display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black">
+=== <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">Risc&nbsp;WG</span> ===
 {| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"
 |-
 | Chair
+|
 |}

Antoniok at 19:55, 28 April 2020

2020-04-28T19:55:10Z

@@ Line 41: / Line 41: @@
 |}
-=== <span style="font-size: 18.2520008087158px; line-height: 21.902400970459px;">Risc&nbsp;WG</span> ===
+<parsererror style="display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black">
 {| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"
 |-
 | Chair
+|
 |}

Antoniok at 03:42, 29 October 2015

2015-10-29T03:42:23Z

← Older revision		Revision as of 05:42, 29 October 2015
Line 22:		Line 22:
	The HEART Working Group intends to harmonize and develop a set of privacy and security specifications that would enable an individual to manage the authorization, consent and release of their health related data via RESTful data sharing APIs, and to facilitate the development of interoperable implementations of these specifications by others<br/>List of current working documents / projects are as follows:		The HEART Working Group intends to harmonize and develop a set of privacy and security specifications that would enable an individual to manage the authorization, consent and release of their health related data via RESTful data sharing APIs, and to facilitate the development of interoperable implementations of these specifications by others<br/>List of current working documents / projects are as follows:

	* Health Relationship Trust Profile for OpenID Connect 1.0		*Health Relationship Trust Profile for OpenID Connect 1.0
	* Health Relationship Trust Profile for OAuth 2.0		*Health Relationship Trust Profile for OAuth 2.0
	* Health Relationship Trust Profile for User Managed Access 1.0		*Health Relationship Trust Profile for User Managed Access 1.0
	* Health Relationship Trust Profile for		*Health Relationship Trust Profile for
	* Fast Healthcare Interoperability Resources (FHIR) OAuth 2.0 Scopes		*Fast Healthcare Interoperability Resources (FHIR) OAuth 2.0 Scopes

	\|-		\|-

Antoniok at 18:59, 28 October 2015

2015-10-28T18:59:07Z

← Older revision		Revision as of 20:59, 28 October 2015
Line 1:		Line 1:
	[[File:Openid-r-logo-900x360.png\|300x120px]]		[[File:Openid-r-logo-900x360.png\|300x120px\|Openid-r-logo-900x360.png]]

	~~== <span style="font-size: larger;"></span> ==~~

	~~== <span style="font-size: larger;"></span> ==~~

	~~== <span style="font-size: larger;"></span> ==~~

	== <span style="font-size: larger;">Introduction</span> ==		== <span style="font-size: larger;">Introduction</span> ==

Antoniok at 18:58, 28 October 2015

2015-10-28T18:58:33Z

← Older revision		Revision as of 20:58, 28 October 2015
Line 1:		Line 1:
	~~http~~:~~//ipen.trialog.com/images/ipen/8/8d/~~Openid-r-logo-900x360.png		[[File:Openid-r-logo-900x360.png\|300x120px]]

			== <span style="font-size: larger;"></span> ==

			== <span style="font-size: larger;"></span> ==

			== <span style="font-size: larger;"></span> ==

	== <span style="font-size: larger;">Introduction</span> ==		== <span style="font-size: larger;">Introduction</span> ==

Antoniok: Created page with "http://ipen.trialog.com/images/ipen/8/8d/Openid-r-logo-900x360.png == Introduction ==
2015-10-28T18:57:35Z

Created page with "http://ipen.trialog.com/images/ipen/8/8d/Openid-r-logo-900x360.png == Introduction == Introduction ==

The objective of this page is to provide a high-level view of activities related to privacy standards in the OpenId foundation.[http://openid.net/ http://openid.net/]

"The OpenID Foundation (OIDF) promotes, protects and nurtures the OpenID community and technologies. The OpenID Foundation is a non-profit international standardization organization of individuals and companies committed to enabling, promoting and protecting OpenID technologies. Formed in June 2007, the foundation serves as a public trust organization representing the open community of developers, vendors, and users. OIDF assists the community by providing needed infrastructure and help in promoting and supporting expanded adoption of OpenID. This entails managing intellectual property and brand marks as well as fostering viral growth and global participation in the proliferation of OpenID."

== Current working groups and projects related to privacy standards ==

=== Heart WG ===

{| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"
|-
| Chair
| 
|-
| Overview
|
The HEART Working Group intends to harmonize and develop a set of privacy and security specifications that would enable an individual to manage the authorization, consent and release of their health related data via RESTful data sharing APIs, and to facilitate the development of interoperable implementations of these specifications by others List of current working documents / projects are as follows:

 Health Relationship Trust Profile for OpenID Connect 1.0
 Health Relationship Trust Profile for OAuth 2.0
 Health Relationship Trust Profile for User Managed Access 1.0
 Health Relationship Trust Profile for
 Fast Healthcare Interoperability Resources (FHIR) OAuth 2.0 Scopes

|-
| Web pages
| [http://openid.net/wg/heart/ http://openid.net/wg/heart/]
|-
| Documentation
|
|-
| Comments
|

|}

=== Risc WG ===

{| border="1" cellspacing="1" cellpadding="1" style="line-height: 20.7999992370605px; width: 900px;"
|-
| Chair
| 
|-
| Overview
|
The goal of RISC is to provide data sharing schemas, privacy recommendations and protocols to:

Share information about important security events in order to thwart attackers from leveraging compromised accounts from one Service Provider to gain access to accounts on other Service Providers (mobile or web application developers and owners).
*Enable users and providers to coordinate in order to securely restore accounts following a compromise.

Internet accounts that use email addresses or phone numbers as the primary identifier for the account will be the initial focus.

The working group is currently gathering the requirements and fit and gaps. One of the topics that the WG appreciate is the privacy aspect of the sharing of the account data. In essence, the specification will be describing how to notify the relevant parties when higher account compromise risk were observed. For example, an email provider may provide that the email account now has elevated risk state that the service provider that uses the address as the account reset address may stop using it for the time being. This will prevent the account compromise chain among the service providers and will help maintain the user’s privacy. If the relationship between the email provider above and the service provider is explicit and the user has opted in, then it should not be a problem. However, in most cases, they are implicit. It is conceivable to guide the user to opt-in to this kind of relationship at the next login, but the people who did not opted in will not be protected. If the opt-out was allowed, the first thing the attacker would do after compromising the account is to opt-out from the account risk information sharing so that he can take over the related accounts as well. From our evaluation, one of the best way is for the service provider to share the password reset etc. email address with the email provider in bulk and set up the information sharing path without opt-out option. This will give the greatest privacy protection / privacy risk ratio.

|-
| Web pages
| [http://openid.net/wg/risc/ http://openid.net/wg/risc/]
|-
| Documentation
|
|-
| Comments
|

|}