<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="midBFD4ABB6-F27A-41F5-9B94-57878E764F8B@sxip.com"
type="cite">In my example, I was logging into a blog providing only my
blog URL that was going to be displayed publicly.
<br>
<br>
Clearly if I am moving personal data that is sensitive, I would want
SSL to be used, and just like providing data to forms today, RPs use
SSL when the data is sensitive.
<br>
</blockquote>
I suppose, that if any exchange between the IDP - RP - Client during
authentication is performed in the open (i.e. plain text) it can be
exploit...This means, that the authentication system has been
compromised and would be therefor useless. This can be user/password
pairs but also any shared secret between the parties...<br>
<blockquote cite="midBFD4ABB6-F27A-41F5-9B94-57878E764F8B@sxip.com"
type="cite"><br>
-- Dick
<br>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>