Difference between revisions of "User Stipulation"
From MgmtWiki
(→Context) |
(→Intent Casting) |
||
| Line 22: | Line 22: | ||
*The following example assumes a richer format for intent casting that is not yet defined. | *The following example assumes a richer format for intent casting that is not yet defined. | ||
**See the [https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=80053232 page on stalking] on Kantara. | **See the [https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=80053232 page on stalking] on Kantara. | ||
| − | Here are the potential terms to be cast. | + | Here are the potential terms to be cast |
| + | {|border="1" padding="2" width="799px" | ||
| + | | Name || OIDC || Priv Risk|| Notes | ||
| + | |- | ||
| + | |openid ||yes||0 || requests access to the user_id (sub) [[Claim]] which is here assumed to be pair-wise unique for the privacy score. | ||
| + | |- | ||
| + | |profile ||yes ||4 || requests that access to the End-User’s profile Claims excluding the address and email Claims. | ||
| + | |||
| + | |- | ||
| + | |email|| yes|| 4|| requests that access to the email and verified Claims | ||
| + | } | ||
==References== | ==References== | ||
Revision as of 18:05, 18 October 2018
Full Title or Meme
- A statement from a User as to the behavior that the user expects of a Web Site.
- A condition, requirement, or item specified in a legal instrument. [1]
Context
There are at least two sources of User Stipulation:
- The user can create a statement to be send to the correspondent Web Site informing the site as to the expectations of the user. (aka intent casting e.g. Do Not Track)
- The Web Site can provide the user with some sort of document (terms of use, privacy policy, etc.) that the user can accept or reject.
This page does not presently include user settings on a User Device.
Problems
Compliance by the Web Site with the agreed terms will be hard to track.
Solutions
- The page Cookies has some description of user cookies that have been proposed as a source of user stipulations.
- The Best Practice shows one way to track user expressed intent within a Relying Party database.
Intent Casting
This solution covers the projection of user terms onto a correspondent Web Site.
- An existing example is the DNT (Do Not Track) HTTP header.
- The following example assumes a richer format for intent casting that is not yet defined.
- See the page on stalking on Kantara.
Here are the potential terms to be cast
| Name | OIDC | Priv Risk | Notes |
| openid | yes | 0 | requests access to the user_id (sub) Claim which is here assumed to be pair-wise unique for the privacy score. |
| profile | yes | 4 | requests that access to the End-User’s profile Claims excluding the address and email Claims. |
| yes | 4 | requests that access to the email and verified Claims
} References
|
