<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ryan Barrett wrote:<br>
<blockquote
cite="midPine.LNX.4.64.0610201249450.14206@heaven.corp.google.com"
type="cite">"up to the IdP" does not mean "won't be used." IdPs that
use OpenID in
<br>
meaningful transactions - say, PayPal, or the DMV - will almost
certainly use
<br>
SSL to protect sensitive data like passwords on the wire. all they're
saying
<br>
is that OpenID doesn't *mandate* it.
<br>
</blockquote>
Well....today domain validated certification is available for very low
cost or free...Therefore I'm not sure, if the argument of costs is
valid anymore. Here it's about the transport of the critical data, e.g.
the user details. If the same details can be open and sniffed by a
third party on-route, than it might be re-used to access secured sites
as well? Is there a protection against this? Otherwise it doesn't
matter if Paypal uses encryption, if a simple sniffer can get the
required bits from another (unsecured) site more easy?<br>
<br>
Authentication of user submitted data is another story, which would
require at some point a validation system....So I'm not sure, if the
specs have a trust bit for these...??? This would be an interesting
point for more critical transactions of course...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
<div><br>
</div>
</div>
</body>
</html>