[OpenID] 2-Headed OpenID Auth for Increased Security?

[Eric Norman]

On Nov 30, 2008, at 9:35 AM, Andrew Arnott wrote:

> I like the idea.... but the XRDS would have to mandatorily not be 
> hosted by either OP (which right now is commonly done), since that OP 
> would still ultimately have total assertion power by temporarily 
> manipulating the XRDS file to point to two OP endpoints that were both 
> controlled by the evil party.

Be careful.  "Hosted by" does not necessarily imply "content
controlled by".

Eric Norman