Formulate response to WebID / IsLoggedIn proposals

[gffletch]

Google’s WebID proposal is looking to tacking 4 core “issues” for users leveraging browsers to navigate the web:

1. Block/separate advertising bounce tracking from identity federation flows
2. Prevent RP collusion leveraging globally correlateable identifiers shared by the IDP
3. Prevent IDPs knowing where the user is logging in before the user actually authenticates
4. Separate Authentication flows from authorization flows as many web use cases just require authentication

Apple’s IsLoggedIn proposal is looking to enable the browser to intermediate identity flows and manage a bit for whether the user is logged in.

[Tom Jones]

I would like to rephrase

3. Prevent IDPs knowing where the user is logging in before the user consents.

I know Geo & I disagree, but I think user consent is ALWAYS required here.

nb. user consent can be cached.

[Nat Sakimura]

We can continue discussing here as well as in the special calls.

[Tim Cappalli]

Agenda for first special topic call