<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="mid6DDAB92A-87AF-4A5A-82DD-1D610AC99033@sxip.com"
type="cite">Mixing them does make sense. I provide my username and
password to my IdP over SSL. The results of that are an assertion that
I own a URL and that can be sent to the RP over HTTP since my URL is
not sensitive.
<br>
</blockquote>
But home sites which are not using SSL are a problem...except that the
result of the assertion can be transfered in plain is just another
one...<br>
<blockquote cite="mid6DDAB92A-87AF-4A5A-82DD-1D610AC99033@sxip.com"
type="cite">it is, and I am trying to say that other people have
different opinions then you, and I am not going to force them to do
something they don't want to do -- actually, we won't be able to force
them, they will just not adopt the protocol
<br>
</blockquote>
Oh, that's a good one....: According to the current definition, my
company can be a homesite (also with certain risks), but never, ever
can provide login anywhere at the same companies own sites, since other
homesites might not be secured...Now I let you decide, which adoption
you are probably going to hurt most...Guess, that more serious
companies are simply not going to adopt it....<br>
<br>
Looking at Verisign's PIP....Does Verisign also rely on it for login on
their sites? Without checking this out...I simply guess, that I can't
login anywhere are their sites using OpenID.....and right so!<br>
<blockquote cite="mid6DDAB92A-87AF-4A5A-82DD-1D610AC99033@sxip.com"
type="cite">I think we are going in circles here. </blockquote>
It seems so...<br>
<blockquote cite="mid6DDAB92A-87AF-4A5A-82DD-1D610AC99033@sxip.com"
type="cite">I have explained why not require it. </blockquote>
No....I didn't hear one valid argument which makes sense....except that
you don't want to force people adopt a standard like SSL....<br>
<br>
On an other occasion you said, that this is not even the most critical
security issue you have to solve....So I wonder, why not solve at least
one of them....<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>