Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add normative requirements regarding media type and proof #1014

Closed
wants to merge 4 commits into from
Closed

Add normative requirements regarding media type and proof #1014

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f63e8ea
Add normative requirements regarding proof
OR13 Jan 20, 2023
922ceee
Update index.html
OR13 Jan 20, 2023
9e5485b
Update index.html
OR13 Jan 20, 2023
a99fe01
Update index.html
OR13 Feb 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5132,6 +5132,12 @@ <h2>The <code>application/credential+ld+json</code> Media Type</h2>
the use of a specific media type.
</p>

<p>
This media type MUST NOT be used with <dfn>embedded proof</dfn>.
OR13 marked this conversation as resolved.
Show resolved Hide resolved
OR13 marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
This media type MUST NOT be used with <dfn>embedded proof</dfn>.
This media type MUST NOT be used to describe a verifiable credential with an <dfn>embedded proof</dfn>.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, I'm for removing this statement all together, it doesn't seem to be useful and having it seems unnecessarily restrictive and counterintuitive. A verifiable credential is also a credential. Whether it's safe to use is a matter of actually trying to verify its proof, not some metadata statement specifying a media type. We shouldn't imply otherwise.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this statement +1. When reading this suggested change as an implementer it tells me something very important about how I can handle the data for this media type, that I'm applying different rules to this content than I would if I'm expecting/requiring an embedded proof.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@quartzjer,

Can you make that more concrete with an example? Then, in your example (of your choice), suppose I hand you a credential that has an embedded proof in one case and I hand you a credential that does not in another, but both are tagged with the same media type. What would you do differently and why?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm merging #1014 (comment)

based on the support I can see for it.

Copy link
Member

@msporny msporny Feb 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When reading this suggested change as an implementer it tells me something very important about how I can handle the data for this media type, that I'm applying different rules to this content than I would if I'm expecting/requiring an embedded proof.

Yikes, no that's dangerous to train devs to think in those terms. If you are performing a security process by purely doing media type detection you're setting yourself up for failure... you need to check the security characteristics of the message because we have good data now that developers don't always get media types right. Purely switching off of media type with guidance along the lines of "you can trust this" or "you cannot trust this" enables attackers to have another attack vector. That should probably be what we convey in this media types guidance... that the media type is a decent signal, but you shouldn't be making security decisions purely off of it.

</p>
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<p>
This media type MAY be used with <dfn>external proof</dfn>.
OR13 marked this conversation as resolved.
Show resolved Hide resolved
</p>
</section>


Expand Down