I would argue that by the nature of OAuth tokens not being bound to user 
presence or sessions, it’s not an indication that the user is present 
necessarily, unless you know something additional about the nature of the 
client. But it does tell the AS when the client is active for a particular AS, 
which in some cases is a privacy concern and in others it’s a signal into the 
AS for keeping an eye out for aberrant behavior that a single RS couldn’t 
detect.

This is all a general implication of the introspection process, and not unique 
to this draft. That said, it’s an aspect of privacy that we did not cover in 
the considerations for RFC7662, but I don’t know if it’s appropriate to add 
such a general consideration here.

 — Justin

> On Aug 26, 2020, at 12:52 PM, Dick Hardt <dick.ha...@gmail.com> wrote:
> 
> 
> 
> On Wed, Aug 26, 2020 at 4:37 AM Torsten Lodderstedt 
> <torsten=40lodderstedt....@dmarc.ietf.org 
> <mailto:40lodderstedt....@dmarc.ietf..org>> wrote:
> Hi Denis,
> 
> > On 25. Aug 2020, at 16:55, Denis <denis.i...@free.fr 
> > <mailto:denis.i...@free..fr>> wrote:
> 
> > The fact that the AS will know exactly when the introspection call has been 
> > made and thus be able to make sure which client 
> > has attempted perform an access to that RS and at which instant of time. 
> > The use of this call allows an AS to track where and when 
> > its clients have indeed presented an issued access token.
> 
> That is a fact. I don’t think it is an issue per se. Please explain the 
> privacy implications. 
> 
> As I see it, the privacy implication is that the AS knows when the client 
> (and potentially the user) is accessing the RS, which is also an indication 
> of when the user is using the client.
> 
> I think including this implication would be important to have in a Privacy 
> Considerations section.
> 
> /Dick
> ᐧ
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to