User Story: Service collecting username during an explicit authentication flow within a single service

[hlflanagan]

User story

As a user, I go to my favorite news site and click on sign in because I want to access my saved articles. I am presented with a sign-in screen where I choose to sign in with my local service credentials. My credentials are accepted and I am taken to my profile.

Since I initiated the sign-in flow, I expect the service to collect, store, and use my credentials without asking for explicit permission.

Context of the story

This story applies to a standard consumer authentication flow.

Should this be considered sanctioned or unsanctioned tracking?

This should be considered sanctioned tracking

Explicit list of parties involved

• user
• browser
• service

Complicating characteristics

n/a

Additional information

[hlflanagan]

Discussed during 27 September 2021 fedidcg call