<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="midFBB5774A-E16B-4760-B59F-6DD5B3B2F657@sxip.com"
type="cite">It would be your URL, which likely will be private, and
likely would be contained in content moved from the site later on
insecure anyway even if login was SSL.
<br>
</blockquote>
Well, isn't this the issue here? Or maybe I misunderstood something,
but that's exactly the point...If there can be mixed (secured and
unsecured) sites in this decentralized network, than SSL on one site
might mean nothing...?<br>
<blockquote cite="midFBB5774A-E16B-4760-B59F-6DD5B3B2F657@sxip.com"
type="cite">Your opinion is not shared by the site operators and their
users. Why should everyone operate according to how you think things
should happen? As a user, you have a choice not to use those sites. Why
are you wanting to force your values on others?
<br>
</blockquote>
OK, lets get this strait: It's not MY values, but the formation of a
standard. I don't force anybody anything, but would like to see, that
the standard you are going to create, adopts certain requirements, so
it can be useful...I thought, this is an opportunity to influence
things. <br>
<br>
But to the real beef: You are building a standard and you must decide
how certain things should be...otherwise why bother to create a
standard in first place...The definition says: http, https, xri ....Why
are you forcing operators and users to limit the transport protocol to
this three? What if a operator wants to use something else? Why should
everyone operate according to how you think things should happen and
use either http, https or xri?<br>
<br>
Because you made a decision on this, right? The very same way you (the
community) can make a decision to require https...Hope you get my point
on this...<br>
<blockquote cite="midFBB5774A-E16B-4760-B59F-6DD5B3B2F657@sxip.com"
type="cite">This is like saying that all websites should use SSL and
we should stop allowing HTTP because it is insecure. Where would the
web be if all sites had to run SSL to start off with?
<br>
</blockquote>
Guess, the Internet would be a much better place ;-)<br>
<blockquote cite="midFBB5774A-E16B-4760-B59F-6DD5B3B2F657@sxip.com"
type="cite">These are not issues that have not been discussed in depth
before. Appreciate your feedback, but this is actually not the main
security issue. Adding SSL is pretty straight forward, and a site will
decide to use SSL in the same manner that they decide to use SSL today.
<br>
</blockquote>
Exactly....and because it's already here, common and easy to implement,
why not use it? No need to reinvent the wheel....in return you receive
a much stronger network...Generally speaking, a SSL secured network is
better than plain text, removes/reduces MITM attacks etc...If OpenID
should be anything serious one day, than I can't image anything else
than a minimal set of such requirements....<br>
<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>