Procedural documentation related to privacy

Go back to: OIDplus

Revision: 25 September 2023

Important: This document is written by ViaThinkSoft (the developer of the software "OIDplus") and gives general information on how OIDplus works regarding privacy-related topics. Since OIDplus is a web application that can be downloaded, installed, and operated by anyone on their server systems, this document DOES NOT describe how the owners/administrators of this particular installation of OIDplus are handling your data. Therefore, the owner of this system should provide an additional/individual privacy statement.

Parties / Terminology

ViaThinkSoft is the developer of the software solution "OIDplus".

OIDplus is a software solution to organize, manage and publish information about Object Identifiers (hereinafter referred to as OIDs) and their owners (hereinafter referred to as Registration Authority or RA). It can be downloaded and installed on any server. A particular installation of OIDplus is called OIDplus instance or OIDplus system. Operators of OIDplus instances are usually software developers, workgroups, companies, or other organizations, hereinafter referred to as system owner. A system administrator is a person who manages and maintains the OIDplus software and is usually also the same person who manages the server's hardware and software.

Object Identifiers are organized in a hierarchical structure where Registration Authorities are delegating OIDs underneath the OIDs they are managing, to other Registration Authorities. In the context of a specific Registration Authority and OID, the "Superior RA" is the Registration Authority that has delegated the root OID of a specific Registration Authority. However, the statements about "Superior Registration Authorities" in this document do only apply if the Superior Registration Authority is using OIDplus to delegate the OID.

Definition of server-side and client-side

OIDplus is a web application written in the programming languages PHP (running on the server side) and HTML/JavaScript (running on the client side).

server-side

The PHP scripts of OIDplus are processed through a PHP script interpreter running on top of a web server software ("HTTP web server"), for example, "Apache" or "Nginx". The actual data of OIDplus (OIDs, RAs, …) is stored in a DBMS (Database Management System) e.g. "MySQL", "MariaDB" or "PostgreSQL". The DBMS is usually installed on the same server machine where PHP/Apache is installed, but it can be installed on any machine by the server administrator.

client-side

While the user browses OIDplus, the server side serves HTML and JavaScript content to the client computer. Using web browser software (like "Chrome" or "Firefox"), these contents are processed and displayed on the screen. Various JavaScript scripts are either required to run OIDplus or are improving the user experience, e.g. by reloading OID descriptions without reloading the whole page while the user browses OIDplus. There might be a few external JavaScripts included (e.g. reCaptcha), which are described at the end of the document.

Scope of this document

This document contains information about the OIDplus software only. It is independent of the behavior of the client-side software (web browser, Operating system, firewalls, …), independent from the behavior of hardware (network routers or firewalls, …), independent from the behavior of the server-side software (Apache, PHP, MySQL/MariaDB/PostgreSQL/…, Operating system, etc.) and the practices how the system administrator is operating the server software, stores log files, manages firewalls, etc.

OID information

The main purpose of OIDplus is to show and manage information on OID information.

Some attributes of Object Identifiers (like ASN.1 identifiers) can only be changed by the Superior Registration Authority and not by the Registration Authority of that OID. On the other hand, some other information (like the title and description) can only be changed by the Registration Authority owning the OID and not by the Superior Registration Authority. The system administrator can edit all information.

Hidden OID information

A superior Registration Authority can set the "hidden" flag to an OID they delegate. This means the OID and all its subordinate OIDs are invisible to the public. However, the public can see the existence of hidden OIDs by a notice "XX OIDs are hidden. Log in to see them".

The system administrator can see all OIDs, even if they are hidden.

An owner of an OID can see all OIDs which are directed to his root OID, even if some of them are hidden.

If you are an owner of an OID and want to make your OID hidden from the public, please contact your superior Registration Authority (preferential) or the system administrator and ask them to mark your OID as hidden. Please note that this will also hide all OIDs that you delegate to yourself or other Registration Authorities.

Overview: Managed information about OIDs:

Attribute:	Can only be changed by:	If not marked "hidden", visible to:	If marked "hidden", visible to:
Numeric Identifier (can only be defined during creation and never be changed again)	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Alphanumeric identifier (for ASN.1 notation)	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Unicode label (for IRI notation)	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Registration Authority	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Comment	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
"Hidden" flag	Superior Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Title	Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator
Description	Registration Authority System administrator	Public Registration Authority Superior Registration Authority System administrator	Superior Registration Authority System administrator

Registration Authority information

The information about Registration Authorities owning OIDs can be seen publicly. A Registration Authority can manage their contact data in the OIDplus system (login area) and mark their information as "private" to limit the information visible to the public.

The Following Registration Authority information is always displayed (even if marked "private"):

Overview: Managed information about Registration Authorities:

Attribute:	Can only be changed by:	If not marked "private", visible to:	If marked "private", visible to:
Email-Address	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Public Superior Registration Authority Registration Authority System administrator
Name	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Public Superior Registration Authority Registration Authority System administrator
Organization	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Public Superior Registration Authority Registration Authority System administrator
Office	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Public Superior Registration Authority Registration Authority System administrator
Personal name	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Public Superior Registration Authority Registration Authority System administrator
Privacy flag	Registration Authority	Registration Authority System administrator	Registration Authority System administrator
Street	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator
ZIP/Town	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator
Country	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator
Phone	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator
Mobile	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator
Fax	Registration Authority	Public Superior Registration Authority Registration Authority System administrator	Registration Authority System administrator

Invitation of Registration Authorities

When an OID is created by a Registration Authority or by the system administrator, the owner of the OID will be defined by an email address (which will be shown publicly). Therefore, it is possible to own an OID, even if you are not registered in the OIDplus system.

When the OID is created and the Registration Authority with such an email address does not exist in the OIDplus system, the creator can instruct the system to send an invitation. In that case, an email will be sent to this email address, allowing them to click a link to register to the OIDplus system, so that they can add more contact data as well as be able to delegate and edit OID information.

Currently, a Registration Authority cannot register themselves using the regular login method. (They can register themselves if they are using some alternative login methods as described below). Using the regular login method, they need an invitation from the system administrator or their superior Registration Authority to be able to register to the OIDplus system. (Note: To resend an invitation, the system administrator or superior Registration Authority needs to open your OID and click "Invite RA to join OIDplus" in order to send you an email).

In addition to the invitation system, the system administrator can create Registration Authority accounts without email address verification.

Publishing RAs/OIDs to oid-info.com

oid-info.com is a web page that collects and displays information about OIDs, like a Wiki. OIDplus contains features to submit data from its database to oid-info.com

There are two possibilities:

1. Manual transfer: The system administrator can create an XML file that contains OID and Registration Authority information (only the parts which can be seen by the public anyway) and can upload this XML file to oid-info.com
2. If the OIDplus system is registered to ViaThinkSoft and the OID-info.com transfer is enabled (see below), the OIDplus system will transmit XML data containing RA/OID information through an encrypted interface to ViaThinkSoft, and ViaThinkSoft after regular manual check submits the data to the oid-info.com administrator.

Unique system ID

During the initial setup, a public/private-key-pair will be created which can be used for various purposes, e.g. to encrypt data between OIDplus and ViaThinkSoft if the "system registration" service is used (see below) or to sign OID-IP (previously OID-WHOIS) responses.

From this public key, a unique system ID will be derivated. The unique system ID and the public key can be seen on the setup screen.

System registration and automatic publishing to oid-info.com

During initial setup, the system administrator can choose between the following options:

Privacy Level	Meaning
0	Register to directory service and automatically publish RA/OID data at oid-info.com
1	Only register to directory service
2	Hide system

This setting can always be changed in the administrator login/control panel.

Registering the system to the directory service (options 0 and 1)

The registration of the OIDplus system has various advantages:

• The public key of the OIDplus instance will be published to the ViaThinkSoft web directory so that users can check the integrity of the data (e.g. signed OID-IP/OID-WHOIS requests).
• Since the 31-bit System ID can have hash conflicts, ViaThinkSoft will make sure that the System ID is only used by this OIDplus instance (it will force other OIDplus systems with the same system ID to change their IDs).
• ViaThinkSoft can acknowledge the system name, administrator email address, and OID root arcs. Therefore, the OIDplus instance can be found using Referral WHOIS.
• The administrator can optionally enable the automatic publishing of the public OID information to the repository oid-info.com.
• If the root OID(s) are approved by ViaThinkSoft (it will be manually verified that the root OIDs belong to the system owner), a feature will be unlocked which can be used to compare and import OIDs from oid-info.com into this OIDplus instance.
• The OIDplus version will be reported to ViaThinkSoft. If a severe bug or security vulnerability is affecting this OIDplus instance, ViaThinkSoft can warn the administrator via email.
• The directory service will automatically create an X.509 security certificate for this OIDplus instance (NOT an SSL certificate!) which can be used for various verifications.

If privacy level option 0 or 1 was chosen, the OIDplus system will regularly contact the ViaThinkSoft server through a secure connection and send the following information:

• Privacy level (0, 1, or 2)
• System ID
• Public Key
• Current URL
• Administrator email address
• System title
• List of OID roots that this system is sending
• The version of the system (SVN revision)
• Installation type (SVN snapshot, SVN working copy, or GIT working copy)

ViaThinkSoft will store this data internally and publish parts into the public directory service located at https://www.oidplus.com/directory/:

The public record contains:

• System ID
• Public key
• Current URL

The other information will stay on the ViaThinkSoft internal database and will not be shared with other parties.

If the system administrator enabled this option and wants to revoke the permission, the system administrator has to change the privacy level in the administrator login/control panel. The system will automatically contact the ViaThinkSoft server again and performs the deletion of all data.

Please note that the deletion of the record in the directory service does not delete RA/OID information that is already submitted at oid-info.com (if option 0 was chosen). To delete this data, the system administrator needs to contact the OID Repository Webmaster at admin@oid-info.com

Publish RA/OID data at oid-info.com (option 0)

If privacy level option 0 is chosen, the system regularly contacts the ViaThinkSoft server through a secure connection and sends the public RA/OID data. ViaThinkSoft will store this data and redirect it to the OID Repository Webmaster who will review the data and eventually submit it to the public repository oid-info.com

If the system administrator enabled this option and wants to revoke the permission, the system administrator has to change the privacy level in the administrator login/control panel to option 1 or 2 (to avoid that data being sent again). To remove already submitted OIDs, the system administrator needs to contact the OID Repository Webmaster at admin@oid-info.com

Hide system (option 2)

If privacy level option 2 was chosen, the system will neither contact ViaThinkSoft, nor oid-info.com.

Log files

Logs by OIDplus

OIDplus manages log entries for specific events like logins, RA/OID modifications, creating and deletion of OIDs, etc.

These log messages are stored in the DBMS only.

All log events are visible to the system administrator.

Some events are visible to the Registration Authority and/or the Superior Registration Authority.

Log events may show the IP addresses of the computer that was connected to the OIDplus system and the email address if the Registration Authority was logged in using their credentials.

OIDplus does not provide a function to delete log events. A deletion must be done in the database directly, e.g. using a database client like phpMyAdmin.

Logs by host software, firewalls, etc.

Besides logs created by OIDplus, other client-side or server-side software involved in processing the web requests (like the HTTP web server, the PHP script interpreter, the database server, the Operating System, the web browser, or various firewalls) might log traffic and queries in various ways. These logs are independent of OIDplus and need to be managed by the system administrator and/or network administrators.

If you are concerned about the contents of the log files, please contact the system administrator.

Cookies

A cookie is a small text file that is sent to this website every time you visit it, e.g. to identify you as a logged-in user.

OIDplus does only use cookies for the following purposes:

Cookie	Category	Usage	Will be created:	Will be deleted:
Login-Cookie	Essential	Contains a server-signed "JSON Web Token" (JWT) that contains the username.	During the login of a user or administrator using their password.	When the user logs out.
SSL-Detect-Cookie	Essential	If the option "automatic SSL detection" is enabled by the system administrator, this cookie will check if the SSL port is open, to allow automatic redirection of HTTP to HTTPS.	During the first page visit over HTTPS, or after the first SSL detection.	When the browser session is closed.
Language Cookie	Essential	The language cookie contains the desired language.	As soon as a flag is clicked, or if an URL was opened that has a lang=… argument	When the browser session is closed.
CSRF token (2x)	Essential	Contains a random string that will be embedded into the page, as a counter-measure against "Cross-Site Request Forgery" (CSRF) attacks.	As soon as the page is opened using a JavaScript-compatible web browser.	When the browser session is closed.

This list of cookies only applies to the main system. Third-party OIDplus plugins might use more cookies.

External JavaScripts

During the loading of the web page, various JavaScripts are included to improve the user experience and add essential functionalities. The basic scripts are the JavaScript files of OIDplus itself, which are stored on the server of the particular OIDplus installation.

The following JavaScripts are loaded from an external source/server:

reCAPTCHA (only if plugin "reCAPTCHA" is enabled)

To protect sensitive functions of OIDplus (e.g. the login form) from hackers, the system administrator can enable "reCAPTCHA" which is a service of Google. Before enabling reCAPTCHA in the OIDplus setup/settings, the system administrator has to request an API key from Google. The usage of reCAPTCHA will probably introduce additional cookies that are out of the control of OIDplus.

Please see Google's Privacy Policy and Terms of service for more information.

If the system administrator has not enabled the reCAPTCHA feature, no external script will be included at all.

If the feature is enabled, blocking the reCAPTCHA JavaScript on the client side will result in various functionalities (like the login form) not working.

hCaptcha (only if plugin "hCaptcha" is enabled)

To protect sensitive functions of OIDplus (e.g. the login form) from hackers, the system administrator can enable "hCaptcha" which is a service of Intuition Machines, Inc. Before enabling hCaptcha in the OIDplus setup/settings, the system administrator has to request an API key from Intuition Machines, Inc. The usage of hCaptcha will probably introduce additional cookies that are out of the control of OIDplus.

Please see Intuition Machines, Inc.'s Privacy Policy and Terms of service for more information.

If the system administrator has not enabled the hCaptcha feature, no external script will be included at all.

If the feature is enabled, blocking the hCaptcha JavaScript on the client side will result in various functionalities (like the login form) not working.

Additional security / access controls

System administrators can choose other methods to disable access from the public, e.g. by using firewalls (so that clients cannot access the server at all) or by setting up password protection at the level of the HTTP web server software (e.g. "Basic Auth" on Apache, so that the clients cannot access the directory where OIDplus is installed in).

Encrypted network connections

The server administrator is responsible for securing the network connections using "HTTPS". This is done at the HTTP web server level (i.e. an Apache module/setting) and independent from OIDplus.

Administrator login procedure

The administrator login requires a password that is stored in a local configuration file. It is stored using a "salted hash" which is like a "one-way encryption" and therefore, the plain password cannot be seen by anyone who is reading the configuration file.

The configuration file is generated by a "setup" utility and can be manually edited by the system administrator.

Registration Authority Login procedures

There are several ways to log in as a Registration Authority:

• Regular log-in method
• Log in using Google (optional plugin for OIDplus)
• Log in using Facebook (optional plugin for OIDplus)
• Log in using LDAP/ActiveDirectory (optional plugin for OIDplus)

Regular log-in method

With the login method, the Registration Authority logs in using a password they defined. The password is stored in the database using a "salted hash" which is like "one-way encryption". Therefore, the system administrator cannot see the password in the database table.

Login using Google

This alternative login method is an optional plugin that can be enabled by the administrator.

When the user clicks the "login using Google" link, they will be redirected to a Google "consent" screen where they can log in using their Google account credentials. (This procedure is called OAuth2) Note that this consent screen contains a Google-specific privacy policy and terms of service. Once you have logged in, Google will redirect the user back to OIDplus and sends a signed message which contains the following information about the person who has logged in:

• Email address
• Verification status of the E-Mail address (must be verified)
• Personal name
• Language/Region setting (this information will not be evaluated by OIDplus and will be discarded)
• Link to profile picture (this information will not be evaluated by OIDplus and will be discarded)
• OpenID (this information will not be evaluated by OIDplus and will be discarded)

The Google password is not transmitted to OIDplus.

If it is the first time the user has logged in, then OIDplus will then create a new Registration Authority account in the local database that contains this information. The account is yet password-less, therefore it can only be used for OAuth authentication.

The user can optionally define a password in case they want to additionally use the regular login method.

If the Registration Authority has a password-less account, then they cannot change their email address, because the OIDplus implementation of OAuth2 uses the email address as identification instead of the "OpenID" as usual. If they want to change their email address, then they must create a password first and then use the regular login method using the new email address.

Login using Facebook

This alternative login method is an optional plugin that can be enabled by the administrator.

When the user clicks the "login using Facebook" link, they will be redirected to a Facebook "consent" screen where they can log in using their Facebook account credentials. (This procedure is called OAuth2) Note that this consent screen contains a Facebook-specific privacy policy and terms of service. Once you have logged in, Facebook will redirect the user back to OIDplus and sends a signed message which contains the following information about the person who has logged in:

• Email address
• Personal name
• User ID (this information will not be evaluated by OIDplus and will be discarded)

The Facebook password is not transmitted to OIDplus.

Facebook preserves permission to hand over the e-mail address so that the consent screen is not displayed in later login attempts. These consents are managed in the "App" permissions in the Facebook account and can also be revoked there.

If it is the first time the user has logged in, then OIDplus will then create a new Registration Authority account in the local database that contains this information. The account is yet password-less, therefore it can only be used for OAuth authentication.

The user can optionally define a password in case they want to additionally use the regular login method.

If the Registration Authority has a password-less account, then they cannot change their email address, because the OIDplus implementation of OAuth2 uses the email address as identification instead of the "user id" as usual. If they want to change their email address, then they must create a password first and then use the regular login method using the new email address.

Attention: Deleting the "App" in your Facebook settings will not remove the account in OIDplus. You need to remove your OIDplus account first, and then remove the "App" permission in your Facebook account.

Login using LDAP / ActiveDirectory

This alternative login method is an optional plugin that can be enabled by the administrator.

LDAP / ActiveDirectory is a technology where a server managed authentication for several services (like Windows computers, intranet, network shares, and mail accounts) and is usually used in large company networks.

In comparison to the usual login where the user enters the username and password, OIDplus will ask for an email address and password.

The email address is an optional field in the LDAP / ActiveDirectory database, therefore the network administrator must set the email addresses of each user in the network, so they can log in to OIDplus.

Once the user has entered the username and password, OIDplus will connect to the LDAP server and search for a user that fits the entered email address. When a user is found, OIDplus will check if the password fits the LDAP user.

Once this procedure was successful, OIDplus will fetch the following information from the LDAP server (if available in the LDAP directory):

• "Common name" (CN)
• "Display name"
• Given name
• Surname (SN)
• Company
• Physical delivery office name
• Department
• Street address
• Postal code
• Locality (L)
• Country (CO)
• Phone number(s)
• Mobile phone number
• Fax number

If it is the first time the user has logged in, then OIDplus will then create a new Registration Authority account in the local database that contains this information. The account is yet password-less, therefore it can only be used for LDAP authentication.

The user can optionally define a password in case they want to additionally use the regular login method.

If the Registration Authority has a password-less account, then they cannot change their email address, because the OIDplus implementation of LDAP / ActiveDirectory uses the email address as identification instead of the username as usual. If they want to change their email address, then they must create a password first and then use the regular login method using the new email address.