Shibboleth Developers

["Scott Cantor" <>]

> Putting all that in the metadata, and then turning around and trying to
> present that all to the user, as well the attributes to be released and
> their values, sounds like one ends up creating a web page with so much
info
> the average user will never read it (like EULAs). But asking services to
> have a web page with its privacy policy, why it needs the attributes and
> what it will do with them (and how it will protect them), and putting a
URL
> pointing to that web page in the metadata (and presenting that URL on the
> consent page) might work. (Still probably won't get the average user to go
> and read that page, but at least you've tried.)

I've been involved in more than one brainstorming session about coming up
with iconography to represent "typical" policies that would be
understandable to users, and I could imagine embedding identifiers of that
sort in the metadata rather than expecting users to read detailed policies,
which we know they won't do.

-- Scott