[cryptography] Client certificate crypto with a twist

Ben Laurie ben at links.org
Thu Oct 11 04:45:00 EDT 2012


On Wed, Oct 10, 2012 at 4:34 PM, Joe St Sauver <joe at oregon.uoregon.edu> wrote:
> The nice part about Shib, from a privacy POV, is that you only release/get
> the attributes that may be necessary (thereby preserving user privacy).

A rather optimistic view of federated identity...

a) Who determines what is "necessary" and how?

b) How do you prevent collusion between SPs or SPs and IdPs?



More information about the cryptography mailing list