Subject: [OAUTH-WG] November Interim meeting on WebID/IsLoggedIn followup

From: Vittorio Bertocci <[email-masked]>
Date: Fri, 22 Jan 2021 19:30:06 +0000

Dear all,
This is a followup on the actions we agreed upon during the November interim meeting in November (notes in https://datatracker.ietf.org/meeting/interim-2020-oauth-12/materials/minutes-interim-2020-oauth-12-202011021200-00). Apologies for the delay.
The TL;DR is that we decided it might be useful to put together a document that describes the identity scenarios relying on current browser features and that we’d like to preserve.
Such document should help grounding discussions with browser vendors by making it easy to pinpoint how specific changes might impair functionality in important scenarios, and what functionality we are trying to preserve (in case the new browser feature can offer alternate path to the same outcomes).

Tackling on all the possible scenarios is too big a task for George and myself alone, hence we devised a proposed mechanism to generate and maintain that list collaboratively.
You can find a framing proposal in https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00, and the github repo workspace https://github.com/IDBrowserUseCases/docs. Thanks to Daniel and Torsten for their help on figuring out how to use mmark to write internet drafts.

We do have a list of candidate scenarios, but before going too deep in it we wanted to give the group the chance to take a look at the model and get your feedback before we charge down that path. This is a pretty unusual collaboration model and getting it to work might be tricky.
Please let us know what you think!

Cheers
G&V

---

From: Sam Goto <[email-masked]>
Date: Mon, 25 Jan 2021 15:09:33 -0800

On Fri, Jan 22, 2021 at 11:30 AM Vittorio Bertocci <vittorio.bertocci=
[email-masked]> wrote:

> Dear all,
>
> This is a followup on the actions we agreed upon during the November
> interim meeting in November (notes in
> https://datatracker.ietf.org/meeting/interim-2020-oauth-12/materials/minutes-interim-2020-oauth-12-202011021200-00).
> Apologies for the delay.
>
> The TL;DR is that we decided it might be useful to put together a document
> that describes the identity scenarios relying on current browser features
> and that we’d like to preserve.
>
> Such document should help grounding discussions with browser vendors by
> making it easy to pinpoint how specific changes might impair functionality
> in important scenarios, and what functionality we are trying to preserve
> (in case the new browser feature can offer alternate path to the same
> outcomes).
>
>
>
> Tackling on all the possible scenarios is too big a task for George and
> myself alone, hence we devised a proposed mechanism to generate and
> maintain that list collaboratively.
>
> You can find a framing proposal in
> https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00,
> and the github repo workspace https://github.com/IDBrowserUseCases/docs.
> Thanks to Daniel and Torsten for their help on figuring out how to use
> mmark to write internet drafts.
>
>
>
> We do have a list of candidate scenarios, but before going too deep in it
> we wanted to give the group the chance to take a look at the model and get
> your feedback before we charge down that path. This is a pretty unusual
> collaboration model and getting it to work might be tricky.
>

Thanks Vittorio for kicking this off and I just wanted to stop by and say
that this seems like a wonderful starting point. I read your introduction
(which I think has done a great job in capturing the intent), your
template, and your initial test use case and I think this is a great
starting point.

More specifically:

- I really like how you are positioning this effort.
- I really like the section on scoping
<https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00#section-1.1>,
primarily on what not to cover: any scenario not currently in mainstream. I
know this is an over categorization, and I don't believe this was your
intent, but just for clarification, we would welcome scenarios under
"consumers" , "EDU" in addition to "enterprises" (I get the irony of the
section above "classifying most other cases as enterprise use cases hence
solvable by exceptions and local business policies" -- point taken).
- The template
<https://datatracker.ietf.org/doc/html/draft-bertocci-identity-in-browser-00#section-4>
LGTM. There is a chance it will evolve as we write more and we read more,
but this is a good starting point. Here are a few ways that I think this
could evolve:
  - perhaps a section with "Possible
technologies/announcements/APIs/features that may pose a risk to this
scenario" would be constructive to indicate "X (use case) breaks with Y
(browser API)".
  - I have a sense that we would want to extend/break down "Privacy
Considerations". One way to make this more concrete, is possibly to
cross-reference one of the privacy threat models (e.g. ours is here: Privacy
Threat Model
<https://github.com/WICG/WebID/blob/master/privacy_threat_model.md>) so
that we can collect something like "X (use case) conflicts with Y (privacy
threat)". Cross-referencing the threat model will also be useful in giving
you a sense of the threats we are set to address too.

I'll be watching the repository and looking forward to hearing from you,

Thanks again,

Sam

>
> Cheers
>
> G&V
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>