<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dick Hardt wrote:<br>
<blockquote cite="mid46F28D00-1B39-4B43-A610-687F77BF60D2@sxip.com"
type="cite">
<pre wrap="">Lots of people would consider those sites to be really useful! ...
but that is off-topic. :-)
</pre>
</blockquote>
Yes...also we do...but that's indeed off-topic ;-)<br>
<blockquote cite="mid46F28D00-1B39-4B43-A610-687F77BF60D2@sxip.com"
type="cite">
<pre wrap="">
In 1994, people forecasting we would be doing online banking, but it
was several years before that happened.
Similarly, I see OpenID being used in pretty straightforward
applications initially, and then in more sensitive applications as
the technology matures and it is understood.
There is a pretty straight forward extension mechanism for OpenID. I
foresee the use of DNSSEC and PKI in the future with OpenID. Same
general conversation, but with significantly more security.
</pre>
</blockquote>
Excellent! This is what it should be, to start with...<br>
<blockquote cite="mid46F28D00-1B39-4B43-A610-687F77BF60D2@sxip.com"
type="cite">
<pre wrap="">
In other words, we start with the low risk areas where a boo-boo
won't be disastrous. We add layers of security over time and a site
dials up the amount of security they require for their application.
Please have patience. We are all wanting the same thing. It is
important to deal with the reality of who will deploy solutions like
this today and get OpenID 2.0 out the door.
</pre>
</blockquote>
No problem. However the required changes actually would be minimal to
the specs and requiring SSL would be a good start...This would others
allow to join really. Why not deal with some of the weak designs now?
Personally I would be much in favor for this...obviously...<br>
<blockquote cite="mid46F28D00-1B39-4B43-A610-687F77BF60D2@sxip.com"
type="cite">
<pre wrap="">
It would be great for you guys to help design extensions that are
more secure for the future.
</pre>
</blockquote>
Absolutely! We got involved, because we want to be a help, not to be a
pain in the a**. I think, we could start with part of it now (SSL
perhaps) and continue with other security design features later. I
would have here a few ideas for that, which would be protocol/flow
specific...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>