Re: [Gen-art] Gen-ART Last Call review of draft-ietf-appsawg-acct-uri-03

Barry Leiba <barryleiba@computer.org> Wed, 06 March 2013 17:02 UTC

Return-Path: <barryleiba@gmail.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DDD611E8142 for <gen-art@ietfa.amsl.com>; Wed, 6 Mar 2013 09:02:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.978
X-Spam-Level:
X-Spam-Status: No, score=-101.978 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z824HlmFSDmU for <gen-art@ietfa.amsl.com>; Wed, 6 Mar 2013 09:02:26 -0800 (PST)
Received: from mail-la0-x229.google.com (mail-la0-x229.google.com [IPv6:2a00:1450:4010:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id DED4211E813F for <gen-art@ietf.org>; Wed, 6 Mar 2013 09:02:25 -0800 (PST)
Received: by mail-la0-f41.google.com with SMTP id fo12so7697186lab.0 for <gen-art@ietf.org>; Wed, 06 Mar 2013 09:02:24 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=UgVWN/XN1j9m8a5mNC3XU2Zq2411lI1JsUyMAknhEXc=; b=NVWjNubudoHIcFUtKnI4vD0YQ2okkqE31JlpCrq4ujktSNtmPfed90RK9OTApTc/5v sNVttKjNaqnFwkkbi7kZ04njNQguJor/CBPcWivR7Ggt4cIF7kpOZmdqsGgttJAb7VcY dCXl1NNC0sCRwbMXAyrBs/pcThNi5fLxdJxgMO+BRDevfgMYUVbq7bAOGVh8faGWUFdv 2lMcHH9VHOdBjQp3KlnbMQIqF0XKSIc7eTHzivNF6bXppHTYQi2ez9gym+5ruHaMAy3u 6eUzde94CoERcYuVtmZxgqnV0PywMh+sVdIS6WFloMAHe3Jjxc3/o2aYOp2XHxDXqB83 +K6A==
MIME-Version: 1.0
X-Received: by 10.112.30.198 with SMTP id u6mr7908885lbh.9.1362589344610; Wed, 06 Mar 2013 09:02:24 -0800 (PST)
Sender: barryleiba@gmail.com
Received: by 10.112.76.98 with HTTP; Wed, 6 Mar 2013 09:02:24 -0800 (PST)
In-Reply-To: <A0B59580-A3C0-4182-8348-5052D16FC6C7@cisco.com>
References: <ABCAA4EF18F17B4FB619EA93DEF7939A09CF57@eusaamb107.ericsson.se> <A0B59580-A3C0-4182-8348-5052D16FC6C7@cisco.com>
Date: Wed, 06 Mar 2013 12:02:24 -0500
X-Google-Sender-Auth: is1pTV7hDXR-QgYXbj0aoFnuL7Y
Message-ID: <CALaySJ+W=PEeuEKzGeiCCG+pg2RncbmW4e4Uv_PrtYu0hVtjGw@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
To: Peter Saint-Andre <psaintan@cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "gen-art@ietf.org" <gen-art@ietf.org>, "draft-ietf-appsawg-acct-uri.all@tools.ietf.org" <draft-ietf-appsawg-acct-uri.all@tools.ietf.org>
Subject: Re: [Gen-art] Gen-ART Last Call review of draft-ietf-appsawg-acct-uri-03
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/gen-art>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Mar 2013 17:02:26 -0000

>> [Page 5] Section 5, "..access to personally identifying information..", do
>> you mean "..access to identifiable personal information" ?
>
> Looking at draft-iab-privacy-considerations, I think "personal data" might
> be best.

Maybe.  But "PII" is a term of art, and it means something different
to (and more specific than) "personal data".  I'm not sure whether the
change is the right answer in the full context of the paragraph:

   Protocols that make use of 'acct' URIs are responsible for defining
   security considerations related to such usage, e.g., the risks
   involved in dereferencing an 'acct' URI and the authentication and
   authorization methods that could be used to control access to
   personally identifying information associated with a user's account
   at a service.

I suppose, as I mull it over, that changing to "personal data"
probably *is* right.  But people should speak up if they think
otherwise.

Barry