Anonymous Sessions?

[Andy Bennett]

Hi,

> There are data structures (SAML2 persistent NameID) designed to limit
> the exposure in such cases, though, giving the SP only a
> service-specific pseudonym, i.e. an identifer that will be the same
> over time for the same subject using the same service, but that does
> not have any meaning (or constitute PII)

I was under the impression that pseudonymous NameIDs *were*
unfortunately considered PII in some jurisdictions (politics being what
is it :-().

http://www.terena.org/activities/refeds/docs/PseudonymousIdentifiersv0.05.pdf




Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/