<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
James A. Donald wrote:<br>
<blockquote cite="mid453CAFA0.3020205@echeque.com" type="cite">
<pre wrap="">To work, OpenID has to be rooted in digital signatures
that the site has chosen to trust. The easiest way is
of course to trust any of the millions of certificates
signed by any of the hundred or so certificate
authorities blessed by the major browsers, </pre>
</blockquote>
Yes, absolutely! Sniffing of user/password pairs will not be possible
anymore (and therefore access to thousands of openid enabled sites
better secured), but also the IDP's and relaying RP's have to make some
basic checks on that....
<blockquote cite="mid453CAFA0.3020205@echeque.com" type="cite">
<pre wrap="">and for most
purposes this will be good enough, but I suspect that
for some applications, this may be excessively liberal,
and the site operator should be able to construct his
own list of acceptable certificates.
</pre>
</blockquote>
This is more problematic, because in such a case, I can go back
spoofing other sites with my own site again....More than that, it's not
enough, that your site trusts it, but all other relying sites have to
trust it as well...This is not an exclusive decision which only affects
your site, but all the sites relying on it...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>