No subject

Fri Aug 15 23:49:43 UTC 2008

RPs cannot leverage cheap, ubiqitous SSL/TLS PKI to help thwart the more
obvious DNS and MITM/phishing attacks. 

BTW, whoever maintains http://openid.net/get/ should probably change the
Yahoo information to "https://me.yahoo.com/" since that works and, unlike
http://openid.yahoo.com/, uses SSL/TLS.

Thanks,

Peter

_______________________________________________
general mailing list
general at openid.net
http://openid.net/mailman/listinfo/general

--0-389835540-1221676953=:23629
Content-Type: text/html; charset=us-ascii

<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt">This comparison is not specific to security, but does address it<br><br>http://identitymeme.org/doc/draft-hodges-saml-openid-compare-06.html<br><br>paul<br><br>p.s. I am a SAML/Liberty participant. I would not argue that OpenID provides 'no' assurance - rather that it can provide a level of assurance appropriate to the use cases that drove its development. I know of no SAML advocate that would claim more than this correspondence for SAML.<br><div>&nbsp;</div>-- <br>Paul Madsen&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;             e:paulmadsen @
 ntt-at.com<br>NTT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;                     p:613-482-0432<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 m:613-302-1428<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; aim:PaulMdsn5<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; web:connectid.blogspot.com<div><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;">----- Original Message ----<br>From: Peter &lt;peterw at tux.org&gt;<br>To: Peter
 Williams &lt;pwilliams at rapattoni.com&gt;<br>Cc: "general at openid.net" &lt;general at openid.net&gt;<br>Sent: Wednesday, September 17, 2008 2:19:46 PM<br>Subject: [OpenID] OpenID architecture critiques? Re: Too many providers...<br><br><br>Peter Williams &lt;<a ymailto="mailto:pwilliams at rapattoni.com" href="mailto:pwilliams at rapattoni.com">pwilliams at rapattoni.com</a>&gt; wrote:<br>&gt; Folks in the liberty alliance message (openly and convincingly)&nbsp; <br>&gt; that openid cannot ever - inherently - be used for any purpose <br>&gt; requiring "assurance". They point to the&nbsp; undisputed claim that <br>&gt; the open designers knowingly made design tradeoffs in the crypto <br>&gt; handshake and security critical securty service composition rules, <br>&gt; so as to make it all easy to deploy and adopt. Because of this <br>&gt; precept, openid cannot even *be* fixed (since low assurance is the <br>&gt; actual goal).<br><br>As someone who's moving towards
 integrating OpenID (RP and OP) into his<br>employer's web apps, I would very much appreciate URLs to such critiques. <br><br>From what I see, the most glaring problem is that some "major sites" that<br>act as OPs (Flickr, AOL, etc.) still do not have https:// identity URLs, so<br>RPs cannot leverage cheap, ubiqitous SSL/TLS PKI to help thwart the more<br>obvious DNS and MITM/phishing attacks. <br><br>BTW, whoever maintains <a href="http://openid.net/get/" target="_blank">http://openid.net/get/</a> should probably change the<br>Yahoo information to "<a href="https://me.yahoo.com/" target="_blank">https://me.yahoo.com/</a>" since that works and, unlike<br><a href="http://openid.yahoo.com/" target="_blank">http://openid.yahoo.com/</a>, uses SSL/TLS.<br><br>Thanks,<br><br>Peter<br><br>_______________________________________________<br>general mailing list<br><a ymailto="mailto:general at openid.net" href="mailto:general at openid.net">general at openid.net</a><br><a
 href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br></div></div></div></body></html>
--0-389835540-1221676953=:23629--