[{"author": "Watson Ladd", "text": "

we hear you

", "time": "2023-10-10T14:00:56Z"}, {"author": "Watson Ladd", "text": "

(now let me figure out where they go)

", "time": "2023-10-10T14:01:59Z"}, {"author": "Andrew Morgan", "text": "


", "time": "2023-10-10T14:02:21Z"}, {"author": "Andrew Morgan", "text": "

yay, thank you Rohan!

", "time": "2023-10-10T14:05:43Z"}, {"author": "Jonathan Rosenberg", "text": "

requirements and open questions look good to me

", "time": "2023-10-10T14:10:47Z"}, {"author": "Jonathan Rosenberg", "text": "

Giles your audio is quite faint

", "time": "2023-10-10T14:11:48Z"}, {"author": "Konrad Kohbrok", "text": "

Wait, why ware we conflating SII to SSI mapping with key distribution?

", "time": "2023-10-10T14:15:44Z"}, {"author": "Konrad Kohbrok", "text": "

Did I miss something?

", "time": "2023-10-10T14:15:59Z"}, {"author": "Alissa Cooper", "text": "

@Konrad, join the queue? There was some confusion about this on the list as well, would be good to clarify.

", "time": "2023-10-10T14:16:25Z"}, {"author": "Rohan Mahy", "text": "

@Konrad, just raise your hand and ask as a clarifying question

", "time": "2023-10-10T14:16:39Z"}, {"author": "Konrad Kohbrok", "text": "

Unfortunately, I'm in a space where I can't talk right now.

", "time": "2023-10-10T14:17:24Z"}, {"author": "Watson Ladd", "text": "

I can't jabberscribe and take notes sadly

", "time": "2023-10-10T14:18:16Z"}, {"author": "Konrad Kohbrok", "text": "

Thanks Alissa!

", "time": "2023-10-10T14:20:48Z"}, {"author": "Benjamin Beurdouche", "text": "

OHTTP++ between Client and P1...

", "time": "2023-10-10T14:33:16Z"}, {"author": "Benjamin Beurdouche", "text": "

P2 sorry

", "time": "2023-10-10T14:33:58Z"}, {"author": "Andrew Morgan", "text": "

Tim's mic is clipping badly for me

", "time": "2023-10-10T14:39:05Z"}, {"author": "Raphael Robert", "text": "

same here

", "time": "2023-10-10T14:39:25Z"}, {"author": "Watson Ladd", "text": "

you will when user changes the preference and forgets to remove from the other

", "time": "2023-10-10T14:40:09Z"}, {"author": "Eric Rescorla", "text": "

Well, you could timestamp the assertions

", "time": "2023-10-10T14:40:24Z"}, {"author": "Watson Ladd", "text": "

I think people still cheat at candy crush saga

", "time": "2023-10-10T14:41:20Z"}, {"author": "Tim Geoghegan", "text": "

Sorry about my mic, I have such bad luck with Meetecho on laptops

", "time": "2023-10-10T14:41:48Z"}, {"author": "Eric Rescorla", "text": "

I was going to make the point Konrad just made

", "time": "2023-10-10T14:42:03Z"}, {"author": "Rohan Mahy", "text": "

what ekr just said!

", "time": "2023-10-10T14:47:55Z"}, {"author": "Rohan Mahy", "text": "

\"is the attacker willing to represent an identity they don't own?\"one provider's assertion is not superior to another's

", "time": "2023-10-10T14:49:19Z"}, {"author": "Alissa Cooper", "text": "

I feel like this is conflating the question of whom you trust to assert UserA's SII->SSI mappings and whom you trust to assert which SSI out of that set is UserA's preferred SSI

", "time": "2023-10-10T14:49:42Z"}, {"author": "Rohan Mahy", "text": "

i don't think it was clear which of these problems the WG was trying to solve.

", "time": "2023-10-10T14:50:20Z"}, {"author": "Alissa Cooper", "text": "

we absolutely must solve the first one, otherwise we don't have a discovery solution that works

", "time": "2023-10-10T14:50:48Z"}, {"author": "Rohan Mahy", "text": "

My position has always been that the first one is completely optional, and the second one is harmful

", "time": "2023-10-10T14:52:24Z"}, {"author": "Eric Rescorla", "text": "

I do actually have a solution to thios

", "time": "2023-10-10T14:54:08Z"}, {"author": "Eric Rescorla", "text": "

this piece

", "time": "2023-10-10T14:54:13Z"}, {"author": "Femi Olumofin", "text": "

It is not quite easy to impersonate a user on a different service using the user's SII like phone number. It is more of a problem for diverse ids - SSI.

", "time": "2023-10-10T14:54:16Z"}, {"author": "Watson Ladd", "text": "

aren't SSIs inherently immune to service B wanting them?

", "time": "2023-10-10T14:55:37Z"}, {"author": "Eric Rescorla", "text": "

I would suggest for the purposes of this discussion we assume PIR is magic

", "time": "2023-10-10T14:56:33Z"}, {"author": "Eric Rescorla", "text": "

Rather than talking about lattics :)

", "time": "2023-10-10T14:56:47Z"}, {"author": "Eric Rescorla", "text": "

With that said, people might find this useful https://educatedguesswork.org/posts/pir/

", "time": "2023-10-10T14:57:04Z"}, {"author": "Eric Rescorla", "text": "

(which is to say PIR explained entirely with high school math)

", "time": "2023-10-10T14:57:14Z"}, {"author": "Rohan Mahy", "text": "

@Ekr, to be clear, I think we can technically solve the second problem.

", "time": "2023-10-10T14:58:40Z"}, {"author": "Rohan Mahy", "text": "

1) My concerns are that people often use different services for different contexts. I want to use different services to talk with my colleagues (Wire), to talk to my family (Messages), and to talk to member of my acrobatics troup (WhatsApp).

", "time": "2023-10-10T14:58:41Z"}, {"author": "Rohan Mahy", "text": "

2) I fear this will become like the \"Make this my default browser\" wars

", "time": "2023-10-10T14:59:12Z"}, {"author": "Rohan Mahy", "text": "

but worse

", "time": "2023-10-10T14:59:20Z"}, {"author": "Rohan Mahy", "text": "

I want to use an explicit service. I don't want a default one.

", "time": "2023-10-10T15:00:19Z"}, {"author": "Tim Geoghegan", "text": "

In this design, the client has no visibility into the SII->SSI mappings. It gets told by its service frontend what other service to use. So regardless of a preferred service setting, the frontend can just pick a provider based on its own preferences.

", "time": "2023-10-10T15:01:49Z"}, {"author": "Jonathan Rosenberg", "text": "

@rohan does this cover your requirements: https://datatracker.ietf.org/doc/html/draft-rosenberg-mimi-discovery-reqs-00#name-provider-cardinalities

", "time": "2023-10-10T15:01:55Z"}, {"author": "Eric Rescorla", "text": "

I want to use an explicit service. I don't want a default one. and nothing stops you from doing it, but that's not what everyone wants

", "time": "2023-10-10T15:03:43Z"}, {"author": "Eric Rescorla", "text": "

Oops. @Rohan, I know you want an explicit selection, but not everyone wants that

", "time": "2023-10-10T15:04:15Z"}, {"author": "Eric Rescorla", "text": "

@Femi: do you have these numbers in core seconds rather than absolute times?

", "time": "2023-10-10T15:07:30Z"}, {"author": "Tim Geoghegan", "text": "

+1 to needing a threat model. Also need to be clear on which actor is trusted to select among multiple providers.

", "time": "2023-10-10T15:15:18Z"}, {"author": "Raphael Robert", "text": "

would be good to have a written threat model

", "time": "2023-10-10T15:16:11Z"}, {"author": "Eric Rescorla", "text": "

It's worth noting that in this design, you have to do N queries where N is the number of potential services the person you are talking to might have

", "time": "2023-10-10T15:16:42Z"}, {"author": "Eric Rescorla", "text": "

Which may be fine, but is gonna be pretty expensive if that's a PIR query

", "time": "2023-10-10T15:17:12Z"}, {"author": "Eric Rescorla", "text": "

Another question I would add is whether the shard boundaries are going to change

", "time": "2023-10-10T15:17:28Z"}, {"author": "Eric Rescorla", "text": "

Re: PIR algorithm selection, I think we'd need to send that to CFRG

", "time": "2023-10-10T15:17:47Z"}, {"author": "Eric Rescorla", "text": "

No way should this WG standardize a PIR scheme

", "time": "2023-10-10T15:17:59Z"}, {"author": "Raphael Robert", "text": "


", "time": "2023-10-10T15:18:51Z"}, {"author": "Eric Rescorla", "text": "

With that said, I absolutely love PIR :)

", "time": "2023-10-10T15:19:29Z"}, {"author": "Femi Olumofin", "text": "

@Eric its core seconds.

", "time": "2023-10-10T15:20:35Z"}, {"author": "Giles Hogben", "text": "

The data is already public

", "time": "2023-10-10T15:24:06Z"}, {"author": "Giles Hogben", "text": "

+1 I think we need multiple discovery providers but not because of GDPR

", "time": "2023-10-10T15:31:48Z"}, {"author": "Richard Barnes", "text": "

+1 Coop -- the unanswered question is whether there are not application providers

", "time": "2023-10-10T15:32:08Z"}, {"author": "Eric Rescorla", "text": "

I feel like this is solved with separating authentication/identity from discovery

", "time": "2023-10-10T15:34:30Z"}, {"author": "Richard Barnes", "text": "

@EKR precisely

", "time": "2023-10-10T15:35:24Z"}, {"author": "Eric Rescorla", "text": "

So, I would imagine that in this instance, the big providers are their own CAs

", "time": "2023-10-10T15:35:56Z"}, {"author": "Eric Rescorla", "text": "

the small providers have to use a trusted CA

", "time": "2023-10-10T15:36:04Z"}, {"author": "Eric Rescorla", "text": "

and you can't store records unless you have a valid cert

", "time": "2023-10-10T15:36:15Z"}, {"author": "Richard Barnes", "text": "

i'm pretty sure i wrote up exactly this scheme to the list after the last interim

", "time": "2023-10-10T15:36:21Z"}, {"author": "Eric Rescorla", "text": "

you did

", "time": "2023-10-10T15:36:27Z"}, {"author": "Eric Rescorla", "text": "

I'm just amplifying

", "time": "2023-10-10T15:36:33Z"}, {"author": "Richard Barnes", "text": "

\"allow me to restate...\"

", "time": "2023-10-10T15:36:36Z"}, {"author": "Richard Barnes", "text": "

@ekr i know, it just seems like JDR didn't get that memo

", "time": "2023-10-10T15:37:29Z"}, {"author": "Eric Rescorla", "text": "

PIR solves this problem

", "time": "2023-10-10T15:37:41Z"}, {"author": "Giles Hogben", "text": "

+100 to Richard

", "time": "2023-10-10T15:42:17Z"}, {"author": "Femi Olumofin", "text": "

+1 a discovery provider that is not a service provider shouldn't have the ability to add/update records.

", "time": "2023-10-10T15:42:52Z"}, {"author": "Giles Hogben", "text": "

I don't think the validation process maps to provider

", "time": "2023-10-10T15:54:59Z"}, {"author": "Giles Hogben", "text": "

It maps a meatbag to an identifier

", "time": "2023-10-10T15:55:10Z"}, {"author": "Benjamin Beurdouche", "text": "

Thanks ! Bye : )

", "time": "2023-10-10T16:02:27Z"}, {"author": "Tim Geoghegan", "text": "

Thanks all! Thanks Watson for taking notes.

", "time": "2023-10-10T16:02:32Z"}]