<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Jonathan Daugherty wrote:
<blockquote cite="mid20061020204922.GK17161@janrain.com" type="cite">
<pre wrap=""># Therefore COST is not a valid excuse for bypassing SSL.
I don't think that citing cheap certs is any justification for
requiring it. And that is to say nothing about whether a CA is
trusted.
</pre>
</blockquote>
Well, really the issue isn't the costs perhaps (it was given as a
reason why NOT to require a certain security standard), but the fact,
that the network you are trying to build can be too easy compromised
maybe. But this is not the compromise of one lonely site, it's all the
sites offering openid login...<br>
<br>
The investment to compromise a user login to a forum is perhaps not so
interesting for a hacker, but access to hundreds or thousands of sites
with various levels of information accessible to the (wrongful) user,
would be perhaps disastrous. Personally I thought, that I joined the
discussion very late, specially with the notable involvement of
Verisign at OpenID, but it seems, that there is still some work to be
done ;-) In my opinion, the https protocol is almost the logical
requirement for sites dealing with user login and other
data...Therefore I agree, that not the costs should be the
justification for requiring SSL, but what's at stake for the whole
network.<br>
<br>
So the question was, what is done in order to protect this network and
how data has to be secured on transport and perhaps also on the systems
themselves!?<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
<div><br>
</div>
</div>
</body>
</html>