<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi All....<br>
<br>
My name is Eddy Nigg and I'm the COO of the StartCom CA. This is my
first post to this list, so I decided to introduce myself....<br>
<br>
Pete Rowley wrote:
<blockquote cite="mid45391DC5.10707@redhat.com" type="cite">Despite the
spec being called OpenID Authentication, authentication is actually out
of scope i.e. the actual methods of authentication aren't specified.
The spec really defines a method of third party assertion of an
identifier being linked to a session through an implicit trust
relationship. That's really the context of my "outside the protocol"
qualifier. <br>
</blockquote>
This was actually a question I wanted to ask, because I couldn't find
really an answer, but perhaps was already asked and debated: Is there
an authentication trust bit in the Spec 2.0, such as Class X
verifications at certification authorities. And if not, than the
question is, why not....Or is this in planning for later? And what is
this "outside qualifier"?<br>
<br>
Alaric Dailey wrote:
<blockquote cite="mid45391252.3050908@pengdows.com" type="cite"> This
leads me to a couple of question that I haven't had time to
research (by looking thru the spec)... Other than just getting a sample
member page working. <br>
<br>
Is SSL going to be required (to protect the users data en-route)? <br>
DNSSEC to validate the DNS hasn't been modified?<br>
<br>
</blockquote>
If the "requirements" of SSL (and DNSSEC) are up to the IdP to
implement OpenID securely, how can this network be ever extended beyond
forum and blog logins? Also here I'm a little bit clueless. The specs
speaks about signing of the authentication messages, but there seems to
be no securing (explicit) of the data in any other way?<br>
<br>
Thanks for your answers!
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
<div><br>
</div>
</div>
</body>
</html>