[OpenID] More on the Visa analogy (another question-set for candidates)

[Peter Williams]

Uci is not a "hand out" (aka provision) model. User chooses asserting party. Foundation sets criteria on which openid is reliable. Without https, yadis has spoofing vulnerabilities, which allow attacks on openid discovery (per the spec).

________________________________
From: Johannes Ernst <jernst+openid.net at netmesh.us>
Sent: Friday, December 19, 2008 10:44 PM
To: Chris Messina <chris.messina at gmail.com>
Cc: OpenID List <general at openid.net>
Subject: Re: [OpenID] More on the Visa analogy (another question-set for candidates)

http works for m now. Https is still wrong cert, so let's simply not hand out https URLs ...



On Dec 19, 2008, at 13:48, Chris Messina wrote:

I've had CERT problems with PBWiki before because of the way they do SSL across domains. In other words, their CERT is good for pbwiki.com<http://pbwiki.com>, not openid.net<http://openid.net>.

Not sure how to rectify that.

Does this work any better?

http://wiki.openid.net/Strategy

Chris

On Fri, Dec 19, 2008 at 1:45 PM, Johannes Ernst <jernst+openid.net<http://openid.net>@netmesh.us<http://netmesh.us>> wrote:
On Dec 19, 2008, at 13:34, Chris Messina wrote:
Johannes, please note that the Strategy page is now available at:

https://wiki.openid.net/Strategy

I'm having difficulties getting at it: perhaps there was a DNS change and it has not propagated to me?

And the, I'm getting an invalid cert warning. (but that might be a consequence of the first).




Johannes Ernst
NetMesh Inc.

<lid.gif> <openid.gif> http://netmesh.info/jernst






--
Chris Messina
Citizen-Participant &
 Open Technology Advocate-at-Large

Vote in the OpenID Board Election!
http://tr.im/vote_oidf

factoryjoe.com<http://factoryjoe.com> # diso-project.org<http://diso-project.org>
citizenagency.com<http://citizenagency.com> # vidoop.com<http://vidoop.com>
This email is:   [ ] bloggable    [X] ask first   [ ] private