Attestation - Revision history

Tomjones: /* References */

2020-08-23T04:47:50Z

References

← Older revision		Revision as of 04:47, 23 August 2020
Line 57:		Line 57:
	==References==		==References==
	[[Category: Trust Framework]]		[[Category: Trust Framework]]
			[[Category: Glossary]]
	[[Category: Profile]]		[[Category: Profile]]

Tomjones: /* Full Title */

2019-11-18T04:24:29Z

Full Title

← Older revision		Revision as of 04:24, 18 November 2019
Line 1:		Line 1:
	==Full Title==		==Full Title==
	[[Attestation]] is a certified form of access checking or labeling that gives users or services the information needed to ascertain the trustworthiness of an entity.		[[Attestation]] is a certified form of access checking or labeling that gives users or services the information needed to ascertain the trustworthiness of an entity or software implementation.

	==Context==		==Context==

Tomjones: /* API */

2019-05-23T17:32:32Z

API

← Older revision		Revision as of 17:32, 23 May 2019
Line 41:		Line 41:
	The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known web sites. That type of attack can only be mitigated by giving the user of the web platform the data they need for ascertaining the quality of the web platform before engaging in any significant way.		The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known web sites. That type of attack can only be mitigated by giving the user of the web platform the data they need for ascertaining the quality of the web platform before engaging in any significant way.

	===API===		====API====
	There will be many applications for both users and services to acquire information about the state of a Web Platform's attestation. It is important that a common means of acquiring that information is published. There exists several federation APIs in both SAML and OpenID that can serve as a template for the API, but there is still a need for a general comprehensive specification.		There will be many applications for both users and services to acquire information about the state of a Web Platform's attestation. It is important that a common means of acquiring that information is published. There exists several federation APIs in both SAML and OpenID that can serve as a template for the API, but there is still a need for a general comprehensive specification.

Tomjones: /* Availability of Attestation */

2019-05-23T17:32:14Z

Availability of Attestation

← Older revision		Revision as of 17:32, 23 May 2019
Line 40:		Line 40:
	===Availability of Attestation===		===Availability of Attestation===
	The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known web sites. That type of attack can only be mitigated by giving the user of the web platform the data they need for ascertaining the quality of the web platform before engaging in any significant way.		The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known web sites. That type of attack can only be mitigated by giving the user of the web platform the data they need for ascertaining the quality of the web platform before engaging in any significant way.

			===API===
			There will be many applications for both users and services to acquire information about the state of a Web Platform's attestation. It is important that a common means of acquiring that information is published. There exists several federation APIs in both SAML and OpenID that can serve as a template for the API, but there is still a need for a general comprehensive specification.

	===Example of Audit Attestation===		===Example of Audit Attestation===

Tomjones: /* Framework or Profile Attestation */

2019-05-23T16:48:55Z

Framework or Profile Attestation

← Older revision		Revision as of 16:48, 23 May 2019
Line 25:		Line 25:
	The best attestations are performed by a [[Trusted Third Party]] that is known to a community of users. This will involved at least a framework profile and a service. As the service branches out to increasing levels of security and privacy it is likely that more levels of specificity, as outlined above, will be desirable.		The best attestations are performed by a [[Trusted Third Party]] that is known to a community of users. This will involved at least a framework profile and a service. As the service branches out to increasing levels of security and privacy it is likely that more levels of specificity, as outlined above, will be desirable.
	===Framework or Profile Attestation===		===Framework or Profile Attestation===
	These are both as set of rules that others might follow. They are attested by a couple of methods:		These are both as set of rules that others might follow. They are attested (trusted) by a couple of methods:
	# The creators of the artifacts themselves evaluate the effectiveness as the are typically subject matter experts (SMEs) in the field.		# The creators of the artifacts themselves evaluate the effectiveness as the are typically subject matter experts (SMEs) in the field.
	# Wide implementation is a prerequisite for any standard artifact to gain credence.		# Wide implementation is a prerequisite for any standard artifact to gain credence.

Tomjones: /* Self Attestation */

2019-05-23T16:45:24Z

Self Attestation

← Older revision		Revision as of 16:45, 23 May 2019
Line 33:		Line 33:
	===Self Attestation===		===Self Attestation===
	* All attestation regimes start with a list of required "features" that must be supported in order to gain the right to display an attestation mark. It is important that the candidate service provider understand the cost and benefit of the [[Attestation]] before they undertake the effort to acquire the mark or badge or API response that shows conformance.		* All attestation regimes start with a list of required "features" that must be supported in order to gain the right to display an attestation mark. It is important that the candidate service provider understand the cost and benefit of the [[Attestation]] before they undertake the effort to acquire the mark or badge or API response that shows conformance.
	* Self attestation can be recorded and the results can be evaluated and posted. This is the way that the initial [https://idefregistry.edufoundation.kantarainitiative.org/ IDEF registry] is implemented. ~~They do~~ have a concierge service to help with the process, but the results are submitted by the ~~site~~ owner.		* Self attestation can be recorded and the results can be evaluated and posted. This is the way that the initial [https://idefregistry.edufoundation.kantarainitiative.org/ IDEF registry] is implemented. That registry does have a concierge service to help with the process, but the results are submitted by the web platform owner.

	===Audited Attestation===		===Audited Attestation===

Tomjones: /* Self Attestation */

2019-05-23T16:44:11Z

Self Attestation

← Older revision		Revision as of 16:44, 23 May 2019
Line 32:		Line 32:

	===Self Attestation===		===Self Attestation===
	* All attestation regimes start with a list of required "features" that must be supported in order to gain the right to display an attestation mark. It is important that candidate service understand the cost and benefit of the [[Attestation]] before they undertake the effort to acquire the mark or badge or API response that shows conformance.		* All attestation regimes start with a list of required "features" that must be supported in order to gain the right to display an attestation mark. It is important that the candidate service provider understand the cost and benefit of the [[Attestation]] before they undertake the effort to acquire the mark or badge or API response that shows conformance.
	* Self attestation can be recorded and the results can be evaluated and posted. This is the way that the initial [https://idefregistry.edufoundation.kantarainitiative.org/ IDEF registry] is implemented. They do have a concierge service to help with the process, but the results are submitted by the site owner.		* Self attestation can be recorded and the results can be evaluated and posted. This is the way that the initial [https://idefregistry.edufoundation.kantarainitiative.org/ IDEF registry] is implemented. They do have a concierge service to help with the process, but the results are submitted by the site owner.

Tomjones: /* Components */

2019-05-23T16:41:34Z

Components

← Older revision		Revision as of 16:41, 23 May 2019
Line 11:		Line 11:
	*Framework - in this wiki a trust framework that provides principles.		*Framework - in this wiki a trust framework that provides principles.
	*Profile - details on the application of the framework to a specific vertical or horizontal group of entities.		*Profile - details on the application of the framework to a specific vertical or horizontal group of entities.
	*Web Platform - a digital web site or collection of sites or endpoints that offers services to entities, both digital and (through agents) real-world.		*Web Platform - a digital web site or collection of web sites or endpoints that offers services to entities, both digital and (through agents) real-world.
	*Endpoint - a single digital address providing a specified set of services.		*Endpoint - a single digital address providing a specified set of services.
	*Application - a collection of software that provides a service to entities, both digital and (through agents) real-world.		*Application - a collection of software that provides a service to entities, both digital and (through agents) real-world.

Tomjones: /* Availability of Attestation */

2019-05-23T16:41:06Z

Availability of Attestation

← Older revision		Revision as of 16:41, 23 May 2019
Line 39:		Line 39:

	===Availability of Attestation===		===Availability of Attestation===
	The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known sites. That type of attack can only be mitigated by giving the user of the ~~service~~ the data they need for ascertaining the quality of the ~~service~~ before engaging in any significant way.		The means of validating an attestation must be publicly accessible without cost as the trustworthiness of the service provider must be evident to the user before any sort of transaction even gets underway. This is necessitated by the ability of web sites to spoof well-known web sites. That type of attack can only be mitigated by giving the user of the web platform the data they need for ascertaining the quality of the web platform before engaging in any significant way.

	===Example of Audit Attestation===		===Example of Audit Attestation===

Tomjones: /* Goals */

2019-05-23T16:39:22Z

Goals

← Older revision		Revision as of 16:39, 23 May 2019
Line 4:		Line 4:
	==Context==		==Context==
	===Goals===		===Goals===
	* The immediate goal is that the user of the service recognize the value of conformance to the framework profile.		* The immediate goal is that the user of the web platform service recognize the value of conformance to the framework profile.
	* The end goal is safety and privacy for the end users at an acceptable level of user experience and enterprise cost.		* The end goal is safety and privacy for the end users at an acceptable level of user experience and enterprise cost.