Subject: RE: [dix] Federated Digest Auth

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 2 Mar 2006 11:56:22 -0800

> From: Dick Hardt [mailto:[email-masked]] 
 
> 1) the site does not need to store the data if it only needs 
> it in the transaction. The NYT is a perfect example. They 
> receive profile data to increase demographic counters and 
> potential serve targeted ads. No DB is required. No risk on 
> losing the data.

Lets think this use case through a bit further. Isn't the ultimate goal
of the NYT to prove to advertisers that it is able to deliver a
particular demographic profile?

That said isn't the NYT going to end up having some sort of intermediary
in the authentication chain in the same way they have third parties
hosting their ads or doing other hacks for monitoring views?

Having experienced P3P I am very wary of protocols that expec users to
exercise choice in selecting privacy settings when they are given it.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Dick Hardt <[email-masked]>
Date: Thu, 2 Mar 2006 11:59:36 -0800

> hosting their ads or doing other hacks for monitoring views?

Wether NYT gets the data and aggregates it or someone else, I don't  
see why that matters to the points I am making.

> exercise choice in selecting privacy settings when they are given it.

Not sure what you are getting at wrt. P3P. The user is not  
necessarily selecting their privacy settings. They are choosing to  
either release their data or not. Binary decision.

-- Dick