+1<br><br><div><span class="gmail_quote">On 10/16/06, <b class="gmail_sendername">Drummond Reed</b> <<a href="mailto:drummond.reed@cordance.net">drummond.reed@cordance.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
+1 for building ooTao's ph-off into the browser. It's a great utility -- I<br>use it every day. As Brad says, it's dramatically easier to maintain a short<br>whitelist of real IdPs rather than an infinite blacklist of fake ones.
<br><br>=Drummond<br><br>-----Original Message-----<br>From: <a href="mailto:general-bounces@openid.net">general-bounces@openid.net</a> [mailto:<a href="mailto:general-bounces@openid.net">general-bounces@openid.net</a>] On
<br>Behalf Of Brad Topliff<br>Sent: Monday, October 16, 2006 1:29 PM<br>To: <a href="mailto:general@openid.net">general@openid.net</a><br>Subject: RE: Gathering requirements for in-browser OpenID support<br><br>We (and when I say we, I mean Andy Dale) did some work on this
<br>(<a href="http://xditao.blogspot.com/2006/09/you-should-ph-off.html">http://xditao.blogspot.com/2006/09/you-should-ph-off.html</a>) as a proof of<br>concept. It is alpha code, but it addresses some of the thoughts and
<br>requirements that should go into this.<br><br>To Scott's final comment, one of the big issues to be considered is the<br>logistical difference between showing something obviously POSITIVE when you<br>are at one of your few "trusted" IdPs as opposed to something NEGATIVE when
<br>you are someplace "untrusted" (which is everywhere else).<br><br>-Brad<br><br>-----Original Message-----<br>From: <a href="mailto:general-bounces@openid.net">general-bounces@openid.net</a> [mailto:<a href="mailto:general-bounces@openid.net">
general-bounces@openid.net</a>] On<br>Behalf Of Scott Kveton<br>Sent: Monday, October 16, 2006 12:32 PM<br>To: <a href="mailto:general@openid.net">general@openid.net</a><br>Subject: Re: Gathering requirements for in-browser OpenID support
<br><br>Hey Rob,<br><br>> I'm trying to gather requirements for OpenID support. I think I have a<br>> reasonable understanding of the draft, but part of the appeal of OpenID<br>> is that it doesn't necessarily require browser vendors to do anything :)
<br>><br>> I've seen the proposed 2617-style HTTP authentication scheme on the<br>> wiki. What else could browser vendors do to make OpenID a smoother<br>> experience for users?<br><br>As I posted on the Mozilla wiki:
<br><br><a href="http://wiki.mozilla.org/Firefox/Feature_Brainstorming#Identity">http://wiki.mozilla.org/Firefox/Feature_Brainstorming#Identity</a><br><br>I'd love to see some anti-phishing mojo baked into the browser. If the user
<br>could set their trusted IdP (or multiple as the case may be) in the browser<br>and then have the browser do something obvious when the users is presented<br>with an "untrusted" page asking for their password that would be great IMHO.
<br><br>- Scott<br><br>_______________________________________________<br>general mailing list<br><a href="mailto:general@openid.net">general@openid.net</a><br><a href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general
</a><br><br><br>_______________________________________________<br>general mailing list<br><a href="mailto:general@openid.net">general@openid.net</a><br><a href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general
</a><br><br>_______________________________________________<br>general mailing list<br><a href="mailto:general@openid.net">general@openid.net</a><br><a href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general
</a><br></blockquote></div><br><br clear="all"><br>-- <br>Jaco Aizenman L.<br>My iname is =jaco (<a href="http://xri.net/=jaco">http://xri.net/=jaco</a>)<br>Founder - <a href="http://www.virtualrights.org">
www.virtualrights.org</a><br>XDI Board member - <a href="http://www.xdi.org">www.xdi.org</a><br>Cofounder CEO - <a href="http://costarricense.com">costarricense.com</a> <br>Tel/Voicemail: 506-3461570 <br>Costa Rica<br>
<br>What is an i-name?<br><a href="http://en.wikipedia.org/wiki/I-name">http://en.wikipedia.org/wiki/I-name</a>