<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="mid792E242D-F7FE-45A5-8AE8-2C981CD2A5A1@sxip.com"
type="cite">Most sites moving sensitive user data use SSL. I predict
that any IdP that does not use SSL is an experimental IdP that is doing
simple authorization. </blockquote>
And what if not? There must be a clear answer....<br>
<blockquote cite="mid792E242D-F7FE-45A5-8AE8-2C981CD2A5A1@sxip.com"
type="cite">User's have been educated that the little lock should
appear on sensitive data, and will not want to do sensitive
transactions without it being there.
<br>
</blockquote>
And what if not? What happens then?<br>
<blockquote cite="mid792E242D-F7FE-45A5-8AE8-2C981CD2A5A1@sxip.com"
type="cite">There are many web applications that are not moving
sensitive user data and do not need to employ SSL. Slashdot being an
example. Given their requirements, there is no need to force those
potential RPs to support SSL. Supporting a security gradient is an
important design choice in adoption of an identity due to the wide
spectrum of security requirements of sites.
<br>
</blockquote>
Look, in my opinion there is no reason whatsoever NOT to require SSL. I
didn't heard one good argument for not requiring a minimum set of
security - of which SSL encryption certainly is. It's like you want to
shoot yourself into the foot - instead of preparing for all
possibilities (including critics) the best it can get - without
requesting too much....Today SSL for a web site is affordable and easy
to achieve. OpenID should return "unknown protocol, try https" for
regular http requests...<br>
<br>
Adoption of OpenID might be even higher with a minimal set of security
related requirements, because it shows, that you thought about the
various other aspects - not just the geeky lets-make-it-work standards.
It is going to make this network much more serious in my opinion. It
will also send out a message, that this standard will not just be for
hobbyists and forum, blog logins, but it may extend and expanded to
more serious functions...<br>
<blockquote cite="mid792E242D-F7FE-45A5-8AE8-2C981CD2A5A1@sxip.com"
type="cite">3rd party claims about the URI are out of scope of OpenID
Authentication. OpenID Attribute Exchange enables moving those around.
There is still work to be done on those specifications.
<br>
</blockquote>
Excellent! At which part(s) or papers should I look for these?<br>
<blockquote cite="mid792E242D-F7FE-45A5-8AE8-2C981CD2A5A1@sxip.com"
type="cite">-- Dick
<br>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
<div><br>
</div>
</div>
</body>
</html>