Subversion Repositories oidplus

Rev

Rev 371 | Rev 378 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
217 daniel-mar 1 
<!DOCTYPE html>
2 
 
3 
<html lang="en">
4 
 
5 
<head>
6 
        <title>Procedural documentation related to privacy</title>
7 
</head>
8 
 
9 
<body>
371 daniel-mar 10 
        <style>
11 
        h2 {
12 
                font-size:large !important;
13 
        }
14 
        h3 {
15 
                font-size:medium !important;
16 
        }
217 daniel-mar 17 
        </style>
18 
        <h1>Procedural documentation related to privacy</h1>
375 daniel-mar 19 
        <p><em>Revision: 29 August 2020</em></p>
344 daniel-mar 20 
        <p><strong><em>Important</em></strong><em>: This document is written by ViaThinkSoft (the developer of the software &ldquo;OIDplus&rdquo;) and gives general information on how OIDplus works regarding privacy-related topics. Since OIDplus is a web-software that can be downloaded, installed, and operated by anyone on their server systems, this document DOES NOT describe how the owners/administrators of this particular installation of OIDplus are handling your data. Therefore, the owner of this system should provide an additional/individual privacy statement.</em></p>
219 daniel-mar 21 
        <a name="terminology"></a><h2><strong><u>Parties / Terminology</u></strong></h2>
22 
        <p><strong>ViaThinkSoft</strong> is the developer of the software solution &ldquo;OIDplus&rdquo;.</p>
23 
        <p><strong>OIDplus</strong> is a software solution to organize, manage and publish information about <strong>Object Identifiers</strong> (hereinafter referred to as OIDs) and their owners
24 
        (hereinafter referred to as <strong>Registration Authority</strong> or <strong>RA</strong>).
239 daniel-mar 25 
        It can be downloaded and installed on any server. A particular installation of OIDplus is called <strong>OIDplus instance</strong> or <strong>OIDplus system</strong>.
344 daniel-mar 26 
        Operators of OIDplus instances are usually software developers, workgroups, companies, or other organizations, hereinafter referred to as <strong>system owner</strong>.
27 
        A <strong>system administrator</strong> is a person who manages and maintains the OIDplus software and is usually also the same person who manages the server&rsquo;s hardware and software.</p>
217 daniel-mar 28 
        <p><strong>Object Identifiers</strong> are organized in a hierarchical structure where RAs are delegating OIDs underneath the OIDs they are managing, to other RAs. In the context of a specific RA and OID, the &ldquo;<strong>Superior RA</strong>&rdquo; is the RA that has delegated the root OID of a specific RA. However, the statements about &ldquo;Superior RAs&rdquo; in this document do only apply if the Superior RA is using OIDplus to delegate the OID.</p>
344 daniel-mar 29 
        <a name="server_client_side"></a><h2><strong><u>Definition of server-side and client-side</u></strong></h2>
30 
        <p>OIDplus is a web application written in the programming languages PHP (running on server-side) and HTML/JavaScript (running on the client-side).</p>
31 
        <h3><u>Server-side</u></h3>
369 daniel-mar 32 
        <p>The PHP scripts of OIDplus are processed through a PHP script interpreter running on top of a web server software (&ldquo;HTTP web server&rdquo;), for example, &ldquo;Apache&rdquo; or &ldquo;Nginx&rdquo;. The actual data of OIDplus (OIDs, RAs, &hellip;) is stored in a DBMS (Database Management
33 
        System) e.g. &ldquo;MySQL&rdquo;, &ldquo;MariaDB&rdquo; or &ldquo;PostgreSQL&rdquo;. The DBMS is usually installed on the same server machine where PHP/Apache is installed, but it can be installed on any machine by the server administrator.</p>
344 daniel-mar 34 
        <h3><u>Client-side</u></h3>
375 daniel-mar 35 
        <p>While the user browses OIDplus, the server-side serves HTML and JavaScript contents to the client computer. Using a web browser software (like &ldquo;Chrome&rdquo; or &ldquo;Firefox&rdquo;), these contents are processed and displayed on the screen. Various JavaScript scripts are either required to run OIDplus or are improving the user experience, e.g. by reloading OID descriptions without reloading the whole page while the user browses OIDplus. There might be a few external JavaScripts included (currently only ReCaptcha), which are described at the end of the document.</p>
219 daniel-mar 36 
        <a name="scope"></a><h2><strong><u>Scope of this document</u></strong></h2>
344 daniel-mar 37 
        <p>This document contains information about the OIDplus software only. It is independent of the behavior of the client-side software (web browser, Operating system, firewalls, &hellip;), independent from the behavior of hardware (network routers or firewalls, &hellip;), independent from the behavior of the server-side software (Apache, PHP, MySQL/MariaDB/PostgreSQL/..., Operating system, etc.) and the practices how the system administrator is operating the server software, stores log files, manages firewalls, etc.</p>
219 daniel-mar 38 
        <a name="oid_information"></a><h2><strong><u>OID information</u></strong></h2>
344 daniel-mar 39 
        <p>The main purpose of OIDplus is to show and manage information on OID information.</p>
219 daniel-mar 40 
        <p>Some attributes of Object Identifiers (like ASN.1 identifiers) can only be changed by the Superior RA and not by the RA of that OID. On the other hand, some other information (like the title and description) can only be changed by the RA owning the OID and not by the Superior RA. The system administrator can edit all information.</p>
217 daniel-mar 41 
        <h3><em>Hidden OID information</em></h3>
42 
        <p>A superior RA can set the &ldquo;hidden&rdquo; flag to an OID they delegate. This means the OID and all its subsequent OIDs are invisible to the public. However, the public can see the existence of hidden OIDs by a notice &ldquo;<em>XX OIDs are hidden. Log in to see them</em>&rdquo;.</p>
219 daniel-mar 43 
        <p>The system administrator can see all OIDs, even if they are hidden.</p>
344 daniel-mar 44 
        <p>An owner of an OID can see all OIDs which are directing to his root OID, even if some of them are hidden.</p>
219 daniel-mar 45 
        <p>If you are an <strong>owner of an OID</strong> and want to make your OID hidden from the public, please contact your <strong>superior RA</strong> (preferential) or the <strong>system administrator</strong> and ask them to mark your OID as hidden. Please note that this will also hide all OIDs that you delegate to yourself or other RAs.</p>
217 daniel-mar 46 
        <h3><em>Overview: Managed information about OIDs:</em></h3>
47 
        <table border="1">
48 
        <tbody>
49 
        <tr>
50 
        <td width="111">
51 
        <p><strong>Attribute:</strong></p>
52 
        </td>
53 
        <td width="196">
54 
        <p><strong>Can only be changed by:</strong></p>
55 
        </td>
56 
        <td width="154">
57 
        <p><strong>If not marked &ldquo;hidden&ldquo;, visible to:</strong></p>
58 
        </td>
59 
        <td width="154">
60 
        <p><strong>If marked &ldquo;hidden&ldquo;, visible to:</strong></p>
61 
        </td>
62 
        </tr>
63 
        <tr>
64 
        <td width="111">
65 
        <p>Numeric Identifier</p>
66 
        </td>
67 
        <td width="196">
219 daniel-mar 68 
        <p>Superior RA<br /> System administrator<br /> (can only be defined during creation and never be updated!)</p>
217 daniel-mar 69 
        </td>
70 
        <td width="154">
219 daniel-mar 71 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 72 
        </td>
73 
        <td width="154">
219 daniel-mar 74 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 75 
        </td>
76 
        </tr>
77 
        <tr>
78 
        <td width="111">
79 
        <p>Alphanumeric identifier (for ASN.1 notation)</p>
80 
        </td>
81 
        <td width="196">
219 daniel-mar 82 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 83 
        </td>
84 
        <td width="154">
219 daniel-mar 85 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 86 
        </td>
87 
        <td width="154">
219 daniel-mar 88 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 89 
        </td>
90 
        </tr>
91 
        <tr>
92 
        <td width="111">
93 
        <p>Unicode label</p>
94 
        <p>(for IRI notation)</p>
95 
        </td>
96 
        <td width="196">
219 daniel-mar 97 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 98 
        </td>
99 
        <td width="154">
219 daniel-mar 100 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 101 
        </td>
102 
        <td width="154">
219 daniel-mar 103 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 104 
        </td>
105 
        </tr>
106 
        <tr>
107 
        <td width="111">
108 
        <p>RA</p>
109 
        </td>
110 
        <td width="196">
219 daniel-mar 111 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 112 
        </td>
113 
        <td width="154">
219 daniel-mar 114 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 115 
        </td>
116 
        <td width="154">
219 daniel-mar 117 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 118 
        </td>
119 
        </tr>
120 
        <tr>
121 
        <td width="111">
122 
        <p>Comment</p>
123 
        </td>
124 
        <td width="196">
219 daniel-mar 125 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 126 
        </td>
127 
        <td width="154">
219 daniel-mar 128 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 129 
        </td>
130 
        <td width="154">
219 daniel-mar 131 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 132 
        </td>
133 
        </tr>
134 
        <tr>
135 
        <td width="111">
136 
        <p>&ldquo;Hidden&rdquo; flag</p>
137 
        </td>
138 
        <td width="196">
219 daniel-mar 139 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 140 
        </td>
141 
        <td width="154">
219 daniel-mar 142 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 143 
        </td>
144 
        <td width="154">
219 daniel-mar 145 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 146 
        </td>
147 
        </tr>
148 
        <tr>
149 
        <td width="111">
150 
        <p>Title</p>
151 
        </td>
152 
        <td width="196">
219 daniel-mar 153 
        <p>RA<br /> System administrator</p>
217 daniel-mar 154 
        </td>
155 
        <td width="154">
219 daniel-mar 156 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 157 
        </td>
158 
        <td width="154">
219 daniel-mar 159 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 160 
        </td>
161 
        </tr>
162 
        <tr>
163 
        <td width="111">
164 
        <p>Description</p>
165 
        </td>
166 
        <td width="196">
219 daniel-mar 167 
        <p>RA<br /> System administrator</p>
217 daniel-mar 168 
        </td>
169 
        <td width="154">
219 daniel-mar 170 
        <p>Public<br /> RA<br /> Superior RA<br /> System administrator</p>
217 daniel-mar 171 
        </td>
172 
        <td width="154">
219 daniel-mar 173 
        <p>Superior RA<br /> System administrator</p>
217 daniel-mar 174 
        </td>
175 
        </tr>
176 
        </tbody>
177 
        </table>
219 daniel-mar 178 
        <a name="ra_information"></a><h2><strong><u>RA information</u></strong></h2>
344 daniel-mar 179 
        <p>The information about RAs owning OIDs can be seen publicly. A RA can manage their contact data in the OIDplus system (login-area) and mark their information as &ldquo;private&rdquo; to limit the information visible to the public.</p>
180 
        <p>Following RA information is always displayed (even if marked &ldquo;private&rdquo;):</p>
217 daniel-mar 181 
        <h3><em>Overview: Managed information about RAs:</em></h3>
182 
        <table border="1">
183 
        <tbody>
184 
        <tr>
185 
        <td width="111">
186 
        <p><strong>Attribute:</strong></p>
187 
        </td>
188 
        <td width="196">
189 
        <p><strong>Can only be changed by:</strong></p>
190 
        </td>
191 
        <td width="154">
192 
        <p><strong>If not marked &ldquo;private&ldquo;, visible to:</strong></p>
193 
        </td>
194 
        <td width="154">
195 
        <p><strong>If marked &ldquo;private&ldquo;, visible to:</strong></p>
196 
        </td>
197 
        </tr>
198 
        <tr>
199 
        <td width="111">
200 
        <p>Email-Address</p>
201 
        </td>
202 
        <td width="196">
203 
        <p>RA</p>
204 
        </td>
205 
        <td width="154">
219 daniel-mar 206 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 207 
        </td>
208 
        <td width="154">
219 daniel-mar 209 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 210 
        </td>
211 
        </tr>
212 
        <tr>
213 
        <td width="111">
214 
        <p>Name</p>
215 
        </td>
216 
        <td width="196">
217 
        <p>RA</p>
218 
        </td>
219 
        <td width="154">
219 daniel-mar 220 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 221 
        </td>
222 
        <td width="154">
219 daniel-mar 223 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 224 
        </td>
225 
        </tr>
226 
        <tr>
227 
        <td width="111">
228 
        <p>Organization</p>
229 
        </td>
230 
        <td width="196">
231 
        <p>RA</p>
232 
        </td>
233 
        <td width="154">
219 daniel-mar 234 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 235 
        </td>
236 
        <td width="154">
219 daniel-mar 237 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 238 
        </td>
239 
        </tr>
240 
        <tr>
241 
        <td width="111">
242 
        <p>Office</p>
243 
        </td>
244 
        <td width="196">
245 
        <p>RA</p>
246 
        </td>
247 
        <td width="154">
219 daniel-mar 248 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 249 
        </td>
250 
        <td width="154">
219 daniel-mar 251 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 252 
        </td>
253 
        </tr>
254 
        <tr>
255 
        <td width="111">
256 
        <p>Personal name</p>
257 
        </td>
258 
        <td width="196">
259 
        <p>RA</p>
260 
        </td>
261 
        <td width="154">
219 daniel-mar 262 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 263 
        </td>
264 
        <td width="154">
219 daniel-mar 265 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 266 
        </td>
267 
        </tr>
268 
        <tr>
269 
        <td width="111">
270 
        <p>Privacy flag</p>
271 
        </td>
272 
        <td width="196">
273 
        <p>RA</p>
274 
        </td>
275 
        <td width="154">
276 
        <p>RA</p>
219 daniel-mar 277 
        <p>System administrator</p>
217 daniel-mar 278 
        </td>
279 
        <td width="154">
280 
        <p>RA</p>
219 daniel-mar 281 
        <p>System administrator</p>
217 daniel-mar 282 
        </td>
283 
        </tr>
284 
        <tr>
285 
        <td width="111">
286 
        <p>Street</p>
287 
        </td>
288 
        <td width="196">
289 
        <p>RA</p>
290 
        </td>
291 
        <td width="154">
219 daniel-mar 292 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 293 
        </td>
294 
        <td width="154">
295 
        <p>RA</p>
219 daniel-mar 296 
        <p>System administrator</p>
217 daniel-mar 297 
        </td>
298 
        </tr>
299 
        <tr>
300 
        <td width="111">
301 
        <p>ZIP/Town</p>
302 
        </td>
303 
        <td width="196">
304 
        <p>RA</p>
305 
        </td>
306 
        <td width="154">
219 daniel-mar 307 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 308 
        </td>
309 
        <td width="154">
310 
        <p>RA</p>
219 daniel-mar 311 
        <p>System administrator</p>
217 daniel-mar 312 
        </td>
313 
        </tr>
314 
        <tr>
315 
        <td width="111">
316 
        <p>Country</p>
317 
        </td>
318 
        <td width="196">
319 
        <p>RA</p>
320 
        </td>
321 
        <td width="154">
219 daniel-mar 322 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 323 
        </td>
324 
        <td width="154">
325 
        <p>RA</p>
219 daniel-mar 326 
        <p>System administrator</p>
217 daniel-mar 327 
        </td>
328 
        </tr>
329 
        <tr>
330 
        <td width="111">
331 
        <p>Phone</p>
332 
        </td>
333 
        <td width="196">
334 
        <p>RA</p>
335 
        </td>
336 
        <td width="154">
219 daniel-mar 337 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 338 
        </td>
339 
        <td width="154">
340 
        <p>RA</p>
219 daniel-mar 341 
        <p>System administrator</p>
217 daniel-mar 342 
        </td>
343 
        </tr>
344 
        <tr>
345 
        <td width="111">
346 
        <p>Mobile</p>
347 
        </td>
348 
        <td width="196">
349 
        <p>RA</p>
350 
        </td>
351 
        <td width="154">
219 daniel-mar 352 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 353 
        </td>
354 
        <td width="154">
355 
        <p>RA</p>
219 daniel-mar 356 
        <p>System administrator</p>
217 daniel-mar 357 
        </td>
358 
        </tr>
359 
        <tr>
360 
        <td width="111">
361 
        <p>Fax</p>
362 
        </td>
363 
        <td width="196">
364 
        <p>RA</p>
365 
        </td>
366 
        <td width="154">
219 daniel-mar 367 
        <p>Public<br /> Superior RA<br /> RA<br /> System administrator</p>
217 daniel-mar 368 
        </td>
369 
        <td width="154">
370 
        <p>RA</p>
219 daniel-mar 371 
        <p>System administrator</p>
217 daniel-mar 372 
        </td>
373 
        </tr>
374 
        </tbody>
375 
        </table>
219 daniel-mar 376 
        <a name="ra_invitation"></a><h2><strong><u>Invitation of RAs</u></strong></h2>
377 
        <p>When an OID is created by a RA or by the system administrator, the owner of the OID will be defined by an email address (which will be shown publicly). Therefore, it is possible to own an OID, even if you are not registered in the OIDplus system.</p>
369 daniel-mar 378 
        <p>When the OID is created and the RA with such an email address does not exist in the OIDplus system, the creator will be asked if they want to send an invitation. If they agree, an email will be sent to this email address, allowing them to click a link to register to the OIDplus system, so that they can add more contact data as well as be able to delegate and edit OID information.</p>
344 daniel-mar 379 
        <p>Currently, a RA cannot register themselves. They need an invitation by the system administrator or their superior RA to be able to register to the OIDplus system. (Note: To resend an invitation, the system administrator or superior RA needs to click &ldquo;Update&rdquo; at the OID delegation table, so that they are asked again to send the invitation).</p>
217 daniel-mar 380 
        <p>In addition to the invitation system, the system administrator can create RA accounts without email address verification.</p>
219 daniel-mar 381 
        <a name="oidinfo_publishing"></a><h2><strong><u>Publishing RAs/OIDs to oid-info.com</u></strong></h2>
344 daniel-mar 382 
        <p>oid-info.com is a web page that collects and displays information about OIDs, like a Wiki. OIDplus contains features to submit data of its database to oid-info.com</p>
217 daniel-mar 383 
        <p>There are two possibilities:</p>
384 
        <ol>
219 daniel-mar 385 
                <li>Manual transfer: The system administrator can create an XML file that contains OID and RA information (only the parts which can be seen by the public anyway) and can upload this XML file to oid-info.com</li>
369 daniel-mar 386 
                <li>If the OIDplus system is registered to ViaThinkSoft and the OID-info.com transfer is enabled (see below),
387 
                the OIDplus system will transmit XML data containing RA/OID information through an encrypted interface to ViaThinkSoft,
388 
                and ViaThinkSoft after regular manual check submits the data to the oid-info.com administrator.</li>
217 daniel-mar 389 
        </ol>
219 daniel-mar 390 
        <a name="systemid"></a><h2><strong><u>Unique system ID</u></strong></h2>
362 daniel-mar 391 
        <p>During the initial setup, a public/private-key-pair will be created which can be used for various purposes, e.g. to encrypt data between OIDplus and ViaThinkSoft if the &ldquo;system registration&rdquo; service is used (see below) or to sign OID-WHOIS responses.</p>
217 daniel-mar 392 
        <p>From this public key, a unique system ID will be derivated. The unique system ID and the public key can be seen in the setup screen.</p>
219 daniel-mar 393 
        <a name="system_registration"></a><h2><strong><u>System registration and automatic publishing to oid-info.com</u></strong></h2>
344 daniel-mar 394 
        <p>During initial setup, the system administrator can choose between the following options:</p>
217 daniel-mar 395 
        <p>0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Register to directory service and automatically publish RA/OID data at oid-info.com<br /> 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Only register to directory service<br /> 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Hide system</p>
344 daniel-mar 396 
        <p>This setting can always be changed in the administrator login/control panel.</p>
217 daniel-mar 397 
        <h3><em><u>Registering the system to the directory service (option 0 and 1)</u></em></h3>
362 daniel-mar 398 
        <p>The registration of the OIDplus system has various advantages:</p><!-- please keep in sync with plugins/adminPages/120_registration/info.html document -->
217 daniel-mar 399 
        <ul>
362 daniel-mar 400 
                <li>The public key of the OIDplus instance will be published to the ViaThinkSoft web directory, so that users can check the integrity of the data (e.g. signed OID-WHOIS requests).</li>
401 
                <li>Since the 31-bit System ID can have hash conflicts, ViaThinkSoft will make sure that the System ID is only used by this OIDplus instance (it will force other OIDplus systems with the same system ID to change their IDs).</li>
402 
                <li>ViaThinkSoft can acknowledge the system name, administrator email address, and OID root arcs. Therefore, the OIDplus instance can be found using referral WHOIS.</li>
403 
                <li>The administrator can optionally enable the automatic publishing of the public OID information to the repository oid-info.com.</li>
404 
                <li>If the root OID(s) are approved by ViaThinkSoft (it will be manually verified that the root OIDs belong to the system owner), a feature will be unlocked which can be used to compare and import OIDs from oid-info.com into this OIDplus instance.</li>
405 
                <li>The OIDplus version will be reported to ViaThinkSoft. If a severe bug or security vulnerability is affecting this OIDplus instance, ViaThinkSoft can warn the administrator via email.</li>
406 
                <li>The directory service will automatically create an X.509 security certificate for this OIDplus instance (NOT an SSL certificate!) which can be used for various verifications.</li>
217 daniel-mar 407 
        </ul>
344 daniel-mar 408 
        <p>If privacy level option 0 or 1 was chosen, the OIDplus system will regularly contact the ViaThinkSoft server through a secure connection and send the following information:</p>
217 daniel-mar 409 
        <ul>
219 daniel-mar 410 
                <li>Privacy level (0, 1 or 2)</li>
411 
                <li>System ID</li>
412 
                <li>Public Key</li>
413 
                <li>Current URL</li>
414 
                <li>Administrator email address</li>
415 
                <li>System title</li>
416 
                <li>List of OID roots that this system is sending</li>
362 daniel-mar 417 
                <li>The version of the system (SVN revision)</li>
219 daniel-mar 418 
                <li>Installation type (ZIPed SVN snapshot or SVN working copy)</li>
217 daniel-mar 419 
        </ul>
371 daniel-mar 420 
        <p>ViaThinkSoft will store this data internally and publish parts into the public directory service located at <a href="https://oidplus.viathinksoft.com/directory/">https://oidplus.viathinksoft.com/directory/</a> :</p>
217 daniel-mar 421 
        <p>The public record contains:</p>
422 
        <ul>
219 daniel-mar 423 
                <li>System ID</li>
424 
                <li>Public key</li>
425 
                <li>Current URL</li>
217 daniel-mar 426 
        </ul>
427 
        <p>The other information will stay on the ViaThinkSoft internal database and will not be shared with other parties.</p>
344 daniel-mar 428 
        <p>If the system administrator enabled this option and want to revoke the permission, the system administrator has to change the privacy level in the administrator login/control panel. The system will automatically contact the ViaThinkSoft server again and performs the deletion of all data.</p>
219 daniel-mar 429 
        <p>Please note that the deletion of the record in the directory service does not delete OID/RA information which is already submitted at oid-info.com (if option 0 was chosen). To delete this data, the system administrator needs to contact the OID Repository Webmaster at <a href="mailto:admin@oid-info.com">admin@oid-info.com</a></p>
217 daniel-mar 430 
        <h3><em><u>Publish RA/OID data at oid-info.com (option 0)</u></em></h3>
431 
        <p>If privacy level option 0 is chosen, the system regularly contacts the ViaThinkSoft server through a secure connection and sends the public RA/OID data. ViaThinkSoft will store this data and redirect it to the OID Repository Webmaster who will review the data and eventually submit it to the public repository www.oid-info.com</p>
344 daniel-mar 432 
        <p>If the system administrator enabled this option and want to revoke the permission, the system administrator has to change the privacy level in the administrator login/control panel to option 1 or 2 (to avoid that data is sent again). To remove already submitted OIDs, the system administrator needs to contact the OID Repository Webmaster at <a href="mailto:admin@oid-info.com">admin@oid-info.com</a></p>
217 daniel-mar 433 
        <h3><em><u>Hide system (option 2)</u></em></h3>
434 
        <p>If privacy level option 2 was chosen, the system will neither contact ViaThinkSoft, nor oid-info.com.</p>
219 daniel-mar 435 
        <a name="logfiles"></a><h2><strong><u>Log files</u></strong></h2>
217 daniel-mar 436 
        <h3><em><u>Logs by OIDplus</u></em></h3>
437 
        <p>OIDplus manages log entries for specific events like logins, OID/RA modifications, creating and deletion of OIDs, etc.</p>
438 
        <p>These log messages are stored in the DBMS only.</p>
219 daniel-mar 439 
        <p>All log events are visible to the system administrator.</p>
217 daniel-mar 440 
        <p>Some events are visible to the RA and/or the Superior RA.</p>
441 
        <p>Log events may show the IP addresses of the computer that was connected to the OIDplus system and the email address if the RA was logged in using their credentials.</p>
442 
        <p>OIDplus does not provide a function to delete log events. A deletion must be done in the database directly, e.g. using a database client like phpMyAdmin.</p>
344 daniel-mar 443 
        <h3><em><u>Logs by host software, firewalls, etc.</u></em></h3>
444 
        <p>Besides logs created by OIDplus, other client-side or server-side software involved in processing the web requests (like the HTTP web server, the PHP script interpreter, the database server, the Operating System, the web browser, or various firewalls) might log traffic and queries in various ways. These logs are independent of OIDplus and need to be managed by the system administrator and/or network administrators.</p>
217 daniel-mar 445 
        <p>If you are concerned about the contents of the log files, please contact the system administrator.</p>
219 daniel-mar 446 
        <a name="cookies"></a><h2><strong><u>Cookies</u></strong></h2>
369 daniel-mar 447 
        <p>A cookie is a small text file that is sent to this
448 
        website every time you visit it, e.g. to identify you
449 
        as a logged in user.</p>
217 daniel-mar 450 
        <p>OIDplus does only use cookies for the following purposes:</p>
451 
        <table border="1">
452 
        <tbody>
453 
        <tr>
454 
        <td width="122">
455 
        <p><strong>Cookie</strong></p>
456 
        </td>
457 
        <td width="114">
458 
        <p><strong>Category</strong></p>
459 
        </td>
460 
        <td width="139">
461 
        <p><strong>Usage</strong></p>
462 
        </td>
463 
        <td width="118">
464 
        <p><strong>Will be created:</strong></p>
465 
        </td>
466 
        <td width="126">
467 
        <p><strong>Will be deleted:</strong></p>
468 
        </td>
469 
        </tr>
470 
        <tr>
471 
        <td width="122">
472 
        <p>Login-Cookie</p>
473 
        </td>
474 
        <td width="114">
475 
        <p>Essential</p>
476 
        </td>
477 
        <td width="139">
478 
        <p>Contains a session key that is used to determine the user&rsquo;s log-in-state and the permissions.</p>
479 
        </td>
480 
        <td width="118">
344 daniel-mar 481 
        <p>During the login of a user or administrator using their password.</p>
217 daniel-mar 482 
        </td>
483 
        <td width="126">
484 
        <p>When the user is logged out, and/or the browser session closed.</p>
485 
        </td>
486 
        </tr>
487 
        <tr>
488 
        <td width="122">
489 
        <p>SSL-Detect-Cookie</p>
490 
        </td>
491 
        <td width="114">
492 
        <p>Essential</p>
493 
        </td>
494 
        <td width="139">
344 daniel-mar 495 
        <p>If the option &ldquo;automatic SSL detection&rdquo; is enabled by the system administrator, this cookie will check if the SSL port is open, to allow automatic redirection of HTTP to HTTPS.</p>
217 daniel-mar 496 
        </td>
497 
        <td width="118">
498 
        <p>During the first page visit</p>
499 
        </td>
500 
        <td width="126">
501 
        <p>When the browser session is closed.</p>
502 
        </td>
503 
        </tr>
355 daniel-mar 504 
        <tr>
505 
        <td width="122">
506 
        <p>Language Cookie</p>
507 
        </td>
508 
        <td width="114">
509 
        <p>Essential</p>
510 
        </td>
511 
        <td width="139">
512 
        <p>The language cookie contains the desired language.</p>
513 
        </td>
514 
        <td width="118">
360 daniel-mar 515 
        <p>As soon as a flag is clicked, or if an URL was opened that has a <code>lang=...</code> argument</p>
355 daniel-mar 516 
        </td>
517 
        <td width="126">
518 
        <p>When the browser session is closed.</p>
519 
        </td>
520 
        </tr>
217 daniel-mar 521 
        </tbody>
522 
        </table>
219 daniel-mar 523 
        <a name="external_javascripts"></a><h2><strong><u>External JavaScripts</u></strong></h2>
217 daniel-mar 524 
        <p>During the loading of the web page, various JavaScripts are included to improve the user experience and add essential functionalities. The basic scripts are the JavaScript files of OIDplus itself, which are stored on the server of the particular OIDplus installation.</p>
525 
        <p>There are two JavaScripts which are loaded from an external source/server:</p>
526 
        <h3><em><u>ReCAPTCHA (only if &ldquo;ReCAPTCHA&rdquo; is enabled)</u></em></h3>
344 daniel-mar 527 
        <p>To protect sensitive functions of OIDplus (e.g. the login form) from hackers, the system administrator can enable &ldquo;ReCAPTCHA&rdquo; which is a service of Google. Before enabling ReCAPTCHA in the OIDplus setup/settings, the system administrator has to request an API key from Google. The usage of ReCAPTCHA will probably introduce additional cookies that are out of the control of OIDplus.</p>
528 
        <p>Please see <a href="https://policies.google.com/privacy">Google&rsquo;s Privacy Policy</a> and <a href="https://policies.google.com/terms">Terms of service</a> for more information.</p>
217 daniel-mar 529 
        <p>If the system administrator has not enabled the ReCAPTCHA feature, no external script will be included at all.</p>
344 daniel-mar 530 
        <p>If the feature is enabled, blocking the ReCAPTCHA JavaScript on the client-side will result in various functionalities (like the login form) not working.</p>
219 daniel-mar 531 
        <a name="additional_security"></a><h2><strong><u>Additional security / access controls</u></strong></h2>
344 daniel-mar 532 
        <p>System administrators can choose other methods to disable access from the public, e.g. by using firewalls (so that clients cannot access the server at all) or by setting up password protection at the level of the HTTP web server software (e.g. &ldquo;Basic Auth&rdquo; on Apache, so that the clients cannot access the directory where OIDplus is installed in).</p>
219 daniel-mar 533 
        <a name="encrypted_connections"></a><h2><strong><u>Encrypted network connections</u></strong></h2>
344 daniel-mar 534 
        <p>The server administrator is responsible for securing the network connections using &ldquo;HTTPS&rdquo;. This is done at the HTTP web server level (i.e. an Apache module/setting) and independent from OIDplus.</p>
217 daniel-mar 535 
</body>
536 
 
371 daniel-mar 537 
</html>