Nstic-mit-privacy - Revision history

68.184.32.150 at 14:13, 28 June 2011

2011-06-28T14:13:16Z

← Older revision		Revision as of 14:13, 28 June 2011
Line 1:		Line 1:
	<B>QUICKLINKS:<br>		<B>QUICKLINKS:<br>
	[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS]<br></b>		[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-usability TUESDAY USABILITY PANEL]<br></b>
	<hr>		<hr>
	=FILE NOTES<br><br>National Strategy for Trusted Identities in Cyberspace<br><br>Privacy Workshop=		=FILE NOTES<br><br>National Strategy for Trusted Identities in Cyberspace<br><br>Privacy Workshop=
Line 224:		Line 224:
	(END OF Q-AND-A -- BREAK FOR LUNCH)		(END OF Q-AND-A -- BREAK FOR LUNCH)

	B>QUICKLINKS:<br>		<B>QUICKLINKS:<br>
	[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS]<br></b>		[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-usability TUESDAY USABILITY PANEL]<br></b>

Bill Densmore at 20:41, 27 June 2011

2011-06-27T20:41:09Z

← Older revision		Revision as of 20:41, 27 June 2011
Line 1:		Line 1:
	<B>QUICKLINKS:<br>		<B>QUICKLINKS:<br>
	[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE]<br></b>		[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS]<br></b>
	<hr>		<hr>
	=FILE NOTES<br><br>National Strategy for Trusted Identities in Cyberspace<br><br>Privacy Workshop=		=FILE NOTES<br><br>National Strategy for Trusted Identities in Cyberspace<br><br>Privacy Workshop=
Line 224:		Line 224:
	(END OF Q-AND-A -- BREAK FOR LUNCH)		(END OF Q-AND-A -- BREAK FOR LUNCH)

	<B>QUICKLINKS:<br>		B>QUICKLINKS:<br>
	[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE]<br></b>		[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-breakout BREAKOUT SUMMARY] / [http://www.newshare.com/wiki/index.php?title=Nstic-mit-privacy-report END-OF-DAY-REPORTS]<br></b>

HannesTschofenig: /* Q-and-A starts */

2011-06-27T18:12:18Z

Q-and-A starts

← Older revision		Revision as of 18:12, 27 June 2011
Line 198:		Line 198:
	<I>Harry Halpin, W3C: What are the proper parties to bring to the table? There are actions between the end-users device and an identity provider, or between an end user and the service directory are actually more secure. Who are the correct players to be involved? To what extend is that important: Do we want NSTIC to keep identity providers in the cloud or on devices or what?</I>		<I>Harry Halpin, W3C: What are the proper parties to bring to the table? There are actions between the end-users device and an identity provider, or between an end user and the service directory are actually more secure. Who are the correct players to be involved? To what extend is that important: Do we want NSTIC to keep identity providers in the cloud or on devices or what?</I>

	A: ~~Are~~ the ~~right players~~ at the table ~~and right technologies being considered?~~		<I>Hannes Tschofenig: If you believe that the process has some implications for the outcome then the structure of international organizations has to be considered. Many international organizations mentioned today (e.g. ISO, W3C, ITU-T) have a different model of how they operate. When you want to have the relevant stakeholders at the table then you need to think about open participation. I work in the Internet Engineering Task Force (IETF) that has a very open participation model. Look at organizational structure models. </I>

	Coderre: Don’t assume that any specific industry is automatically an identity provider or a relying party. See how that pans out. As to audit and assurance – people are looking at FIPPS as principles or policies. You don’t assess that – see if it is in place. Assessment criteria would be vague at this point. Don’t ask the audit question quite yet.		Coderre: Don’t assume that any specific industry is automatically an identity provider or a relying party. See how that pans out. As to audit and assurance – people are looking at FIPPS as principles or policies. You don’t assess that – see if it is in place. Assessment criteria would be vague at this point. Don’t ask the audit question quite yet.
Line 207:		Line 207:

	Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?		Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?

	<I>Hannes Tschofenig: If you believe that the process has some implications for the outcome then the structure of international organizations has to be considered. Many international organizations mentioned today (e.g. ISO, W3C, ITU-T) have a different model of how they operate. When you want to have the relevant stakeholders at the table then you need to think about open participation. I work in the Internet Engineering Task Force (IETF) that has a very open participation model. Look at organizational structure models. </I>

	Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”		Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”

HannesTschofenig: /* Q&A session */

2011-06-27T18:09:44Z

Q&A session

← Older revision		Revision as of 18:09, 27 June 2011
Line 83:		Line 83:

	<I>Karen Sollins, MIT: Re internationalism, there are many countries with significantly different models of what privacy and identity mean, and who owns data.</I>		<I>Karen Sollins, MIT: Re internationalism, there are many countries with significantly different models of what privacy and identity mean, and who owns data.</I>

			Hannes Tschofenig, Nokia Siemens Networks: There are three classes of data sharing with relevance for privacy. First, there is the class of user-triggered sharing where the user is presented with a permission dialog before sharing takes place. Examples are linking a Twitter account with Facebook, or many of the Web identity management systems. Second, there is 'outsourcing', which is frequently used for analytics and advertising. The 'Do not Track' and cookie discussion focuses largely on this issue. Finally, there is the use case of aggregated data sharing in the style of the location sharing that Alex Pentland presented in his speech. The technology is different in these different use cases. What areas are being considered for NSTIC? Do you expect that there would be a single mechanism that addresses all these scenarios?

	A: Agrees that concepts are different around the world. May have to go in baby steps before getting to harmonization. Won’t solve overnight.		A: Agrees that concepts are different around the world. May have to go in baby steps before getting to harmonization. Won’t solve overnight.

HannesTschofenig: /* First panel starting: Privacy practice: A case study */

2011-06-27T18:01:50Z

First panel starting: Privacy practice: A case study

← Older revision		Revision as of 18:01, 27 June 2011
Line 117:		Line 117:
	Thibeau: Cosgrove has described the [http://www.educause.edu/Resources/FederalIdentityCredentialandAc/202089 “FICAM”] program, which preceded NSTIC. FICAM showed that real companies can become engaged in privacy issues. Even Level 1 assurance (the lowest level) is useful.		Thibeau: Cosgrove has described the [http://www.educause.edu/Resources/FederalIdentityCredentialandAc/202089 “FICAM”] program, which preceded NSTIC. FICAM showed that real companies can become engaged in privacy issues. Even Level 1 assurance (the lowest level) is useful.

	Thibeau: Talking about standards requires talking about standards. Silicon Valley likes to talk about how slow government works. Thibeau says that is necessary. Standards around privacy and identity in the private sector have also be very slow. ~~OATH~~ is in draft No. 16 and is not finished yet. Open ID 2.0 to Open ID Connect “is very slow, very painful and very tortured.”		Thibeau: Talking about standards requires talking about standards. Silicon Valley likes to talk about how slow government works. Thibeau says that is necessary. Standards around privacy and identity in the private sector have also be very slow. OAuth is in draft no. 16 and is not finished yet. Open ID 2.0 to Open ID Connect “is very slow, very painful and very tortured.”

	Thibeau: “Standards development is a set of compromises between interested parties and it even invokes the P-word – politics.”		Thibeau: “Standards development is a set of compromises between interested parties and it even invokes the P-word – politics.”

	Thibeau: Getting consensus will get you to the much-needed network effect. He thinks there is important evolution within the government and on the private-sector side. ~~O-AUTH~~ and Open ID are taking their place alongside Facebook Connect.		Thibeau: Getting consensus will get you to the much-needed network effect. He thinks there is important evolution within the government and on the private-sector side. OAuth and Open ID are taking their place alongside Facebook Connect.

	There’s a third vector: “And that is what the bad guys are doing. That is the general degradation and trust identity issues on the Internet.” Breach after breach all exploited by the inability of passwords to secure an enterprise or an individual’s privacy and security. “We have this attack vector . . . where we are increasingly working this world . . . where you cannot trust an attachment to an email . . . or caller ID.” The ecosystem is becoming less trustworthy, less commerce, fewer privacy protections. “We do have this third vector, which is going to I think increase the tension and increase the urgency of efforts like NSTIC.”		There’s a third vector: “And that is what the bad guys are doing. That is the general degradation and trust identity issues on the Internet.” Breach after breach all exploited by the inability of passwords to secure an enterprise or an individual’s privacy and security. “We have this attack vector . . . where we are increasingly working this world . . . where you cannot trust an attachment to an email . . . or caller ID.” The ecosystem is becoming less trustworthy, less commerce, fewer privacy protections. “We do have this third vector, which is going to I think increase the tension and increase the urgency of efforts like NSTIC.”

HannesTschofenig: /* Q-and-A starts */

2011-06-27T18:00:03Z

Q-and-A starts

← Older revision		Revision as of 18:00, 27 June 2011
Line 206:		Line 206:
	Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?		Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?

	<I>Hannes Tschofenig: If you believe that the process has some implications for the outcome then the structure of international organizations has to be considered. Many international organizations mentioned today (e.g. ISO, W3C, ITU-T) have a different model of how they operate. When you want to have the relevant stakeholders at the table then you need to think about open participation. Look at organizational structure models. </I>		<I>Hannes Tschofenig: If you believe that the process has some implications for the outcome then the structure of international organizations has to be considered. Many international organizations mentioned today (e.g. ISO, W3C, ITU-T) have a different model of how they operate. When you want to have the relevant stakeholders at the table then you need to think about open participation. I work in the Internet Engineering Task Force (IETF) that has a very open participation model. Look at organizational structure models. </I>

	Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”		Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”

HannesTschofenig: /* Q-and-A starts */

2011-06-27T17:59:05Z

Q-and-A starts

← Older revision		Revision as of 17:59, 27 June 2011
Line 206:		Line 206:
	Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?		Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?

	<I>Q: If the process has some ~~implication~~ for the outcome, then ~~many~~ international organizations have a different model of how they operate. ~~Having~~ stakeholders at the table ~~plays into that~~. Look at organizational structure models. </I>		<I>Hannes Tschofenig: If you believe that the process has some implications for the outcome then the structure of international organizations has to be considered. Many international organizations mentioned today (e.g. ISO, W3C, ITU-T) have a different model of how they operate. When you want to have the relevant stakeholders at the table then you need to think about open participation. Look at organizational structure models. </I>

	Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”		Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”

Bill Densmore at 15:37, 27 June 2011

2011-06-27T15:37:32Z

← Older revision		Revision as of 15:37, 27 June 2011
Line 223:		Line 223:

	(END OF Q-AND-A -- BREAK FOR LUNCH)		(END OF Q-AND-A -- BREAK FOR LUNCH)

			<B>QUICKLINKS:<br>
			[http://www.papertopersona.org WHITE PAPER] / [http://www.infotrust.org INFOTRUST] / [http://www.infovalet.org INFOVALET] / [http://www.rjionline.org RJI ONLINE]<br></b>

Bill Densmore: /* Q-and-A starts */

2011-06-27T15:36:59Z

Q-and-A starts

← Older revision		Revision as of 15:36, 27 June 2011
Line 192:		Line 192:

	Coderre: “Without the clear opportunity to work together instead of apart, it stagnates.”		Coderre: “Without the clear opportunity to work together instead of apart, it stagnates.”


			<I>Harry Halpin, W3C: What are the proper parties to bring to the table? There are actions between the end-users device and an identity provider, or between an end user and the service directory are actually more secure. Who are the correct players to be involved? To what extend is that important: Do we want NSTIC to keep identity providers in the cloud or on devices or what?</I>

			A: Are the right players at the table and right technologies being considered?

			Coderre: Don’t assume that any specific industry is automatically an identity provider or a relying party. See how that pans out. As to audit and assurance – people are looking at FIPPS as principles or policies. You don’t assess that – see if it is in place. Assessment criteria would be vague at this point. Don’t ask the audit question quite yet.

			Stepanovich: Ensuring the right people are at the time is the point of the request that is in circulation now from NSTIC leadership.

			Popowycz: It’s not feasible to manage security on the end-user device – is it jailbroken?

			Titus: This not only a technology issues, it is a policy issue, too. We have learned that we should not carry our social-security card around in our wallets. If I give my identity credential to my wife, is that power of attorney or is it fraud?

			<I>Q: If the process has some implication for the outcome, then many international organizations have a different model of how they operate. Having stakeholders at the table plays into that. Look at organizational structure models. </I>

			Coderre: Make sure the architecture is done right. That is what needs to be agreed to. “Because that will give you the long-term stability that NSTIC will need.”

			<I>John Bradley: OpenID and Kintara: Identity providers are skeptical. Information Cards are dead because no relying parties wanted to use them because they didn’t get enough information. “The notion of people using static PKI certs is largely a dead issue from a relying party point of view. …. Government websites are now taking Facebook IDs. …. There seems to be more focus on creating rules for identity providers rather than for relying parties . . . most of the linkages happen at the relying party . . . are we ignoring where most of the linkage is happening – bad relying parties who are basically collecting people’s information and spamming with it.” </I>

			Coderre: Do you use tobacco as a question has one context in the health industry and another in the insurance industry?

			Slomovic: Do there need to be rules for relying party’s use of data? The answer is use. If you allow your users to log into your site with Facebook, you agree to a bunch of rules about how that experience will work and the information you will get.

			<I>(Observation by Bill Densmore: So here the rules are made by the sole identity provider – Facebook --- rather than by a framework provider). </I>

			Popowycz: Need to make sure rules are clear and unambiguous.

			Titus: Question brings out the difference between retail privacy and wholesale privacy. If behind the scenes stuff is being traded, the retail privacy is illusory because I’ve lost my wholesale privacy. “That is a very realistic risk – we will gain retail privacy at the risk of wholesale privacy.”

			(END OF Q-AND-A -- BREAK FOR LUNCH)

Bill Densmore: /* Q-and-A starts */

2011-06-27T15:20:08Z

Q-and-A starts

← Older revision		Revision as of 15:20, 27 June 2011
Line 183:		Line 183:

	===Q-and-A starts===		===Q-and-A starts===
			Would the same trust network work for both financial and health data?

			Slomovic asks: In the U.S. identity data is not regulated. Should it be? Anybody can start an identity provider “and that would be a completely unregulated enterprise under the current regime as long as their postings and notices are truthful.”

			Stepanovich: “The identity ecosystem imagines many indentity providers, everywhere.” It can range from signing into the Pandora music service vs. a health-care service. She wonders if when there is a legally binding privacy relationship between the two parties, should that be outside the control of the identity ecosystem?

			Titus: Sometimes we regulate information by type, sometimes by covered entity (as in the health-care field). Blood pressure is regulated under health law, but not if I go to a non medical provider and get my blood-pressure checked. “I would like to see us in the United States switch ., . . to a more consistent regime across the board.”

			Coderre: “Without the clear opportunity to work together instead of apart, it stagnates.”