search

WICG / trust-token-api

Trust Token API
https://wicg.github.io/trust-token-api/
Other
425 stars 84 forks source link

Trust Token issuers offering integrations for sites and services they don't own? #79

Open vachadave2 opened 3 years ago

vachadave2 commented 3 years ago

The Trust Token approach requires an issuer entity that is likely to have reasonable context about the level of trust for a given browser instance. In many instances, a given site may not know which issuers are likely to be most viable; one issuer may have sufficient context because of other activity the user did on another site while for a different user it may not have anything of use.

With potential privacy constraints around the number of issuers that can be consulted with (to avoid fingerprinting), it looks likely that various sites would benefit from having a contractual relationship with an issuer that is more likely to have issued a meaningful token in the past.

Are there any potential issuers that can comment on plans to support third-parties entering contractual relationships with them to leverage their issuer to get a trust signal?

bvattikonda commented 3 years ago

We are in the process of starting experiments with the platform provided trust tokens announced here. If the experiments with platform provided trust tokens are successful, we expect to publish documentation for use of the platform provided trust tokens, and we will provide a mechanism to communicate any changes to the encoding algorithm. We have no plans to enter into contractual relationships with third parties for these trust tokens.

dvorak42 commented 3 years ago

@bvattikonda To clarify, that means you plan on making the platform-based trust tokens publicly available/documented to be used by third-parties, but do not have plans to require contractual relationships for third-parties to use those tokens?

To help with some of the discussion, we've added another doc discussing some of the terminology/potential deployment structures for issuers (https://github.com/WICG/trust-token-api/blob/main/DEPLOYMENTS.md).

bvattikonda commented 3 years ago

@bvattikonda To clarify, that means you plan on making the platform-based trust tokens publicly available/documented to be used by third-parties, but do not have plans to require contractual relationships for third-parties to use those tokens?

Yup, we don't plan on requiring contractual relationships or entering into contractual relationships.