CIBA - Clarify privacy issues with login_hint_token and discovery service

[Dave Tonge]

John brought up the point that for CIBA use cases, the user would have to give the RP an identifier to pass to the discovery service. Therefore its unlikely to bring any privacy benefits to CIBA from using an encrypted login_hint_token from a discovery service.

We should update the draft to reflect this.

[Dave Tonge]

I think this can also go in the mobile profile rather than the core profile

[Bjorn Hjelm]

John brought up the point that for CIBA use cases, the user would have to give the RP an identifier to pass to the discovery service. Therefore its unlikely to bring any privacy benefits to CIBA from using an encrypted login_hint_token from a discovery service.

We should update the draft to reflect this.

[Dave Tonge]

This is not addressed by the current draft - I will add text

[Dave Tonge]

https://bitbucket.org/openid/mobile/pull-requests/4

[Dave Tonge]

PR has been merged