<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="mid8D872984-B127-45BE-AD2D-FD8C2BE0181D@sxip.com"
type="cite">
<pre wrap="">
A transaction is only as secure as it's weakest link
</pre>
</blockquote>
Correct! Lets think about where the weakest link is and raise it a few
steps....<br>
<blockquote cite="mid8D872984-B127-45BE-AD2D-FD8C2BE0181D@sxip.com"
type="cite">
<pre wrap="">Perhaps we can discuss this from another point of view. Why should I
need SSL on a blog I am writing a comment on when all the data I
provide the blog will be published and public anyway? An attacker is
not going to see anything more on the HTTP connection then they would
on the blog?
</pre>
</blockquote>
Not entirely correct. If the login details / sessions and whatever is
transmitted in plain, than I can reuse this details perhaps...But this
time it's not going to be used at this blog, but on something more
serious...That was my reasoning, that all transmissions related to the
openid login/access/ whatever has to be secured....Since we are talking
about ONE login details at x sites (can be in the thousands at some
point) and a validity of a session, than the exploit can be almost
disastrous... <br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>