Did-core: PING Horizontal Review

[brentzundel]

• [x] fill out the Security and Privacy Questionnaire
• [x] Contact the PING asking for review.

[brentzundel]

@jonathan-consensyshealth volunteered to fill out the questionairre

[jonnycrunch]

Will forward to my friend and colleague @jonathan-consensysHealth. Would someone please forward me the submission from the VC working group. Also, I'll need help with the threat model section.

[wyc]

@agropper and myself have volunteered to help draft the responses

[agropper]

https://www.eff.org/document/2020-08-04-letter-eff-and-aclu-opposing-ab-2004
seems related.

On Tue, Jul 14, 2020 at 11:44 AM wyc [e-mail] wrote:

@agropper https://github.com/agropper and myself have volunteered to
help draft the responses

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/w3c/did-core/issues/291#issuecomment-658255412, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AABB4YKOZ7EIKMTEQ4JO6ITR3R4NVANCNFSM4NHZSC3Q
.

[wyc]

@agropper @jonnycrunch due to the time passed, would you like to reconvene later this week or early next week in an open-to-did-wg/public meeting and prepare a working item for comments? hopefully there has been some progress on the service endpoint discussions

[jonnycrunch]

yep, how is Monday again? I'll send an invite.

[wyc]

+1, probably a good idea to inform the public did wg list after we figure out where/when.

We can use the CCG Jitsi instance here: https://meet.w3c-ccg.org/DIDSecurityPrivacyReview

[agropper]

+1 for 2PM EST?

On Wed, Aug 12, 2020 at 3:27 PM wyc [e-mail] wrote:

+1, probably a good idea to inform the public did wg list after we figure
out where/when.

We can use the CCG Jitsi instance here:
https://meet.w3c-ccg.org/DIDSecurityPrivacyReview

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/w3c/did-core/issues/291#issuecomment-673065191, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AABB4YKFEEKWCFUNLHVM3PTSALUJHANCNFSM4NHZSC3Q
.

[brentzundel]

@agropper @wyc @jonathan-consensysHealth what is the status of the security and privacy questionnaire?

[wyc]

@brentzundel and those following, the latest response is here:
https://docs.google.com/document/d/13qLCZcks3OAb2V7GHcrSs8s9drA5OaqEPYPI1knmodc/edit#

My apologies, I think I was supposed to write an update to the list and forgot. We are preparing to begin work on sections 3 and 4, but we there were 2 major concerns around scope that would impact the models in those sections significantly:

• DID methods can vary wildly in their function, side effects, and privacy implications. To what point do we address this in the response? Based on his comments in the doc, Orie seems to think that we should focus only on the data models described and not delve too far into these.
• Same concern and question for service endpoints.

[msporny]

We need to have the Security Questionnaire done for this issue to be closed. We cannot close this issue until PING does a review on the specification.

[OR13]

I am adding myself to track contributing to the questionnaire.

[shigeya]

I added a few changes. Reviewed until 2.16.

[kdenhartog]

We're getting closer on the security questionaire with sections covering all of the security parts (section 3 - might need additional points added as well but solid set in there already), but it appears that section 4 needs to be added still. Also, who is currently handling editorship of this document so that we can get the comments merged/resolved? If no one has time to do this I'm happy to step in and carry this to the end, but I'll need editor rights to the document.

@OR13 @wyc @agropper @jonnycrunch

[OR13]

@kdenhartog I added some details, but IMO this needs an editorial merging session, and then we should focus on the weakest parts.

[OR13]

I think the first checkbox is done now?

[brentzundel]

PING has been contacted for review.
Leaving this issue open to track horizontal review efforts.

[burnburn]

PING response of "no blocking issues": https://lists.w3.org/Archives/Public/public-privacy/2021JanMar/0021.html

[agropper]

I'm reminded of the compiler message: "None of the errors detected."

Adrian

On Wed, Feb 24, 2021 at 5:56 PM Daniel Burnett [e-mail]
wrote:

PING response of "no blocking issues":
https://lists.w3.org/Archives/Public/public-privacy/2021JanMar/0021.html

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/w3c/did-core/issues/291#issuecomment-785439265, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AABB4YP3HJQX7YOZMQCQ3K3TAV7YLANCNFSM4NHZSC3Q
.

[brentzundel]

Link to invitation for Security review of Decentralized Identifier Specification v1.0: https://lists.w3.org/Archives/Public/public-web-security/2020Dec/0003.html

No response was received and no issues were raised.

[brentzundel]

Horizontal review is complete, closing