Add security and privacy considerations for services. #101
Conversation
msporny
requested review from
BigBlueHat,
David-Chadwick,
KDean-Dolphin,
PatStLouis,
TallTed,
brentzundel,
davidlehn,
dlongley,
dmitrizagidulin,
iherman,
jandrieu,
longpd and
selfissued
index.html
Outdated
| If a [=controller document=] publishes a [=service=] intended for authentication | ||
| or authorization of the [=subject=] (see Section [[[#services]]]), it is the | ||
| responsibility of the [=service=] provider, [=subject=], and/or requesting party | ||
| to comply with the requirements of the authentication protocols supported at |
There was a problem hiding this comment.
| to comply with the requirements of the authentication protocols supported at | |
| to comply with the requirements of the authentication/authorization protocols supported at |
There was a problem hiding this comment.
My suggestion touches two lines.
| <h2>Service Privacy</h2> | ||
| <p> | ||
| The ability for a [=controller=] to optionally express at least one [=service=] in the [=controller document=] increases their control and agency. | ||
| Each additional endpoint in the [=controller document=] adds privacy risk either |
There was a problem hiding this comment.
| Each additional endpoint in the [=controller document=] adds privacy risk either | |
| Each additional endpoint in the [=controller document=] adds a privacy risk either |
There was a problem hiding this comment.
Indeterminate privacy risk is added with each additional endpoint. It's not "one risk per endpoint". This a should not be inserted.
|
The issue was discussed in a meeting on 2024-10-09
View the transcript3.5. Add security and privacy considerations for services. (pr controller-document#101)See github pull request controller-document#101. Manu Sporny: probably not valuable to look at open PRs, there is an open PR for adding new sections related to services to controller document that needs review. Effectively a copy paste from did core. Brent Zundel: with that we are done for the day. Thank you folks for coming. Thank you Wes-smith for scribing. I will not be able to join the next call but decentralgabe will guest chair for us, we will discuss controller document PRs. |
Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>
|
Editorial, multiple reviews, changes requested and made, no objections, merging. |
6 participants
This PR was supposed to go in as a part of #99; it fixes broken links to sections in Privacy and Security Considerations related to services that were missing in PR #99.
Preview | Diff