[OpenID] Selectively Redirecting OpenID Traffic To HTTPS

[Sean Reilly]

I think the point is that OpenIDs should start with https: so that  
there is no http->https redirection needed.  If any step of the  
process goes through a normal http exchange/redirect then there is a  
weak link in the chain where a bad guy could take over the  
authentication.

Or maybe I'm missing something having jumped into the middle of the  
conversation.

cheers,
sean