<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ryan Barrett wrote:
<blockquote
cite="midPine.LNX.4.64.0610201249450.14206@heaven.corp.google.com"
type="cite">
<pre wrap="">On Fri, 20 Oct 2006, Eddy Nigg (StartCom Ltd.) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">If the "requirements" of SSL (and DNSSEC) are up to the IdP to implement
OpenID securely, how can this network be ever extended beyond forum and blog
logins? Also here I'm a little bit clueless. The specs speaks about signing
of the authentication messages, but there seems to be no securing (explicit)
of the data in any other way?
</pre>
</blockquote>
<pre wrap=""><!---->
"up to the IdP" does not mean "won't be used." IdPs that use OpenID in
meaningful transactions - say, PayPal, or the DMV - will almost certainly use
SSL to protect sensitive data like passwords on the wire. all they're saying
is that OpenID doesn't *mandate* it.
as for DNSSEC, i think josh is right. it's a red herring. sure, DNS is
technically insecure, </pre>
</blockquote>
Therefore its not a red-herring. That is like saying just because its
hard to brute -force a password, or make an MD5 (or SHA-1) collision
happen, or pull-off MITM attack that they are red-herrings. Just
because its hard, it doesn't mean it isn't a real threat.<br>
<blockquote
cite="midPine.LNX.4.64.0610201249450.14206@heaven.corp.google.com"
type="cite">
<pre wrap="">which is a huge temptation for technical people like us
to blow out of proportion. in practice, though, the holes in DNS so awkward,
and require so many resources, that they're almost never exploited in the
wild. it's just not on the script kiddies' radar, much less real criminals'.
big organizations like banks and brokerage firms are ok with conducting
sensitive transactions over plain vanilla DNS. given that precedent, i doubt
we'd want to burn many cycles on DNSSEC.
</pre>
</blockquote>
<br>
They aren't dealing with offloading user-verification to some other
system, AND they use SSL, users data never leaves their site, there
fore the problem doesn't effect them. Furthermore banks, especially US
banks, are perfectly happy with Snake-Oil rather than security. <br>
<br>
<br>
Maybe I am talking to the wrong group of people, but I would have
assumed these issues would already have been resolved and now would
have easy answers.<br>
<br>
<div class="moz-signature">
<div style="font-size: small;"><a
href="http://cert.startcom.org/?app=109"></a><!-- --> </div>
</div>
</body>
</html>