Subject: [abfab] Fwd: feedback on usability draft for abfab

From: Leif Johansson <[email-masked]>
Date: Tue, 14 Jul 2015 14:35:32 +0200

I got this review from Ken Klingenstein of Internet2 and am reposting it
with his permission.

	Cheers Leif

-------- Forwarded Message --------
Subject: 	feedback on usability draft for abfab
Date: 	Mon, 13 Jul 2015 15:45:53 +0000
From: 	Ken Klingenstein <[email-masked]>
To: 	Leif Johansson <[email-masked]>, Rhys Smith <[email-masked]>

Gents,
  Looked it over. Pretty complete. Just one or two comments.

  Sec 3 talks only of authentication and identity. Are there any use
cases where a user will want some degree of privacy and want to release
attributes (maybe packaged as a "pseudo-identity") to allow
privacy-preserving authentication with authorization to use the service
conveyed in the attributes released? Could the SSH keys be associated
with such a pseudo-identity?
  Sec 6.1 recommends storing the password reset URL for an IdP. I would
assume it won't be a particularly volatile URL, but it may change. Is it
advisable to include it then? Having the help desk URL (presumably even
less volatile) would allow a user to traverse to the password location.
  There is a security considerations section, but no privacy
considerations section. Not sure if that is required now in IETF drafts,
but it would be a worthy addition to this doc given its identity
orientation. It might address the points about Section 3 mentioned above.

  That's it. Maybe the long grind is done. Good luck and enjoy Prague.
             Ken

---

From: Sam Hartman <[email-masked]>
Date: Tue, 14 Jul 2015 10:27:43 -0400

So, we definitely have use cases where we use privacy-preserving
identities similar to eduPersonTargetedID, so that's certainly doable.