if their bank suddenly deals in openID identities (instead of e-mail addresses or<br>tipjar nicknames or whatever) yes... although saying "it's the IdP's problem" and<br>moving on should work. shared-secret OTP key fobs are all the rage now AIUI
<br><br><div><span class="gmail_quote">On 1/12/07, <b class="gmail_sendername">Dmitry Shechtman</b> <<a href="mailto:damnian@gmail.com">damnian@gmail.com</a>> wrote:</span>
<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div link="blue" vlink="blue" lang="EN-US"><div><div><p><font color="navy" face="Arial" size="2">
<span style="font-size: 10pt; font-family: Arial; color: navy;">I'm not trying to say there is problem
here, but isn't it way out of our scope? If nobody (well, almost nobody)
can be sure it's really their bank they're signing into, should they
be concerned about their IdP?</span></font></p>
</div></div></div></blockquote></div>