Comments (3)
a) This was not enumerated as one of the blockers in https://mailarchive.ietf.org/arch/msg/rats/IZbS3lpbN6mfBR4IbeTv60DoaiY/
b) Strange that only a review is being requested from the "Android team". Moreover, it seems that an :Android team" review is more important than a WIndows team or IOS team review. Also note that it is not clear who the "Android team" would be,, and whether their assessment actually represents the Android ecosystem in its entirety.
c) Couldn't find evidence of a formal Android team review in the Geopriv standards: see https://mailarchive.ietf.org/arch/browse/geopriv/.
d) Attested location was reviewed by Google/MS in the context of the Web Authn API L1 (https://www.w3.org/TR/webauthn-1/#sctn-location-extension). This work preceded the RATS WG efforts.
e) Could not find where in IETF RFC guidelines where editors are obligated to get formal reviews conducted by vendors of proprietary platforms. We can re-open this issue if someone can provide a pointer to which IETF guideline requires this.
from eat.
It should be noted that location depends on external entities (satellites) for its values which an Attesting Environment can't be certain are correct (as a jamming attack could alter geo-coordinates). The RATS architecture expects the Attesting Environment is design in such a way that the Target Environment can't lie about the measurement produced. In the case of location claim, these exceptions should be noted.
from eat.
It should be noted that location depends on external entities (satellites) for its values which an Attesting Environment can't be certain are correct (as a jamming attack could alter geo-coordinates).
Such a statement assumes that satellites are the only way to derive location. Also, this issue was opened with respect to a request from only the "Android team". The point being raised above should be discussed in a different issue.
from eat.
Related Issues (20)
- can SUEID and UEID be identical? HOT 3
- measurement results claim --- seems too general purpose to be useful HOT 2
- what is purpose of tolerating jti/cti claims HOT 6
- how to find/label Endorsement and Verification Keys HOT 5
- IANA considerations, expert review guidance needs clarity HOT 3
- some advice on freshness would be good HOT 8
- Should spoofed or corrupted location be addressed in the specification? HOT 3
- readers must be familiar with CDDL and CBOR diagnostic format
- add ref to EAT media types
- What are "attestations" HOT 5
- inconsistency in `iat` definition HOT 10
- prohibition around "passing through" claims from evidence to attestation results HOT 7
- IANA Considerations HOT 3
- The value of eat_nonce used in the examples HOT 7
- Security AD Review: clarify sec cons discussion on nonces HOT 1
- Security AD review: address SBOM comments HOT 2
- Security AD review: clarify intuse claim HOT 1
- How far to go with manifest and measurement sub types HOT 1
- use rfc2648 for profile identification HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from eat.