Assurance

["Jones, Mark B" <>]

I strongly disagree.  You can't lump ALL RPs in the "doesn't care" column.  
Strong binding (well... at least LoA2) between authentication credentials and 
their owners has been critical for every use case I have been involved with.  
These are cases that deal with HIPAA, FERPA, PII, PHI.  Maybe these are edge 
cases, but identity vetting less than Silver would be a show stopper.

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Cantor, Scott
Sent: Thursday, November 29, 2012 4:59 PM
To: 

Subject: Re: [Assurance] silver, 2-factor, password requirements

On 11/29/12 5:07 PM, "Tom Scavo" 
<>
 wrote:

>The user isn't the responsible party in this case since we have a 
>signed agreement with the user's organization. This is basically how it 
>works with most (all?) SaaS apps.

And it's left to the organization to decide how much they care about the 
identity of their users, but that's not a cross-organizational assurance 
requirement.

Where this breaks down a bit is trying to federate access to resources in 
that scenario as opposed to just running silos. Mostly it's still left to the 
users owning resources to decide how to care about the binding between 
identifiers and people. The RP doesn't care.

-- Scott