Subject Re: draft charge, refeds working group on attribute release
From "Cantor, Scott E." <cantor.2@xxxxxxx>
Date Fri, 1 Jul 2011 14:58:50 +0000

On 7/1/11 8:40 AM, "Tom Scavo" <trscavo@xxxxxxxxxxxxx> wrote:
>The difference between the two may be technically significant as well. I
>think this is what Scott has been calling "consent lite" in other
>circles. We need to figure out how to implement and deploy these two
>notions independently since one may be easier than the other.

Kind of. I agree with the idea of "notices" vs consent, even to the point
that I'd like to punt them to the SP in many cases.

But what I was calling "lite" is that I think, in contrast to some, that
deploying something like uApprove is not easy and scaling back the
requirements is one way to make it simpler. (Yes, I'm doing that thing I
hate and redefining the problem. Turnabout's fair play.)

In contrast to some who want users to pick and choose attributes, I don't
want to burden users with details at all. I want them to consent to
release of what we call directory information to SPs that meet some
reasonable criteria (the term enhancing education was a good one), do it
once, and be done. No database, some simple logging as an audit trail, a
cookie to track the decision.

If we want wide deployment, I don't believe anything more will fly in the
medium term, and I don't believe focusing on complex attributes that go
beyond this kind of set is where most apps are today.

-- Scott