Subject Re: draft charge, refeds working group on attribute release
From David Chadwick <d.w.chadwick@xxxxxxxxxx>
Date Fri, 01 Jul 2011 19:03:06 +0100

Hi David

thankyou for pointing me to your page

Its quite reassuring to know that the consent system that we have built e.g. here

was done without knowing about your page above, but the resemblance is quite striking as you will no doubt agree.

You will see of course that we have gone one step further than your system and the existing Shibboleth system does, since we expect a user's attributes to be provided by several IDPs and not just one. It is for this reason that our attribute aggregation layer lies above the existing Shibboleth layer, but still relies upon it for user authentication



On 30/06/2011 21:28, David Simonsen wrote:
On Jun 30, 2011, at 8:47 PM, Leif Johansson wrote:
30 jun 2011 kl. 18:17 skrev "David Simonsen"<david@xxxxxxx>:

On Jun 30, 2011, at 10:18 AM, Andrew Cormack wrote:
But I thought we'd already agreed that you can't use consent
for all attribute releases?
When did we agree :) ?
David, there is credible argument questioning the legality of a
consent-only approach.

Leif, that's not how I read it - no-one IMHO has ever questioned the
_legality_ of consent-only. We have different opponions, sure, on
practical issues, about 'necessity' and the role of fedops,
implementation design etc., and put different emphasism on the use of
consent - but I have never percieved that anyone ment that
consent-only is not legal.

Let me expand on why this i not just a question of personal taste.

In 2006/7 WAYF started the investigations on consent-handling with
leading legal experts : - Data protection authorities - The consumer
protection agency - professors (2) of privacy-law (including the main
author behind the present DK legislation) - The national association
of industries (which recently organized the formation of the
Copenhagen Principles,

- the governments legal advisor (pretty expensive law firm)
- German data protection authorities

... and we continue to seek (critical) legal oppinions.

The results are so far: the implementation of the simpleSAMLphp
consent-module, the consent-administration module (withdrawel +
consent), the formulations of the consent dialogue ('purpose_of_the_service'.html
- this one was hard!), policies governing the implementation and
usability studies (with Fraunhofer Institute). So far so good - but
we still see lots of room for improvement, like context-dependent
dialogues (presented to 12-16 year olds etc.).

BTW: I now feel inspired to write a document on the various
requirements, legal and usability considerations the consent system
is the result of (which I have had in mind for time now).

Having discussed this for years I'm really happy about the amount of
attention the subject is finally getting - and look forward to
discussing more.



David W. Chadwick, BSc PhD
Professor of Information Systems Security
School of Computing, University of Kent, Canterbury, CT2 7NF
Skype Name: davidwchadwick
Tel: +44 1227 82 3221
Fax +44 1227 762 811
Mobile: +44 77 96 44 7184
Email: D.W.Chadwick@xxxxxxxxxx
Home Page:
Research Web site:
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5