<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hans Granqvist wrote:
<blockquote cite="mid453E3DFF.7020902@verisign.com" type="cite">
<pre wrap="">To be adopted by many, a protocol should be usable to many.
Some services and people require less stringent security than
others. Some services and people require more. And some people
and services don't really care either way.
</pre>
</blockquote>
The user shouldn't be involved in security related decisions at all. It
should just work and be secure (in my opinion). The same goes for PR's
and to some extend even IDP's. If a PR can't configure a SSL server (as
suggested by someone), than the same PR shouldn't have choices either,
but run by default in "secure mode" or not run it at all....
<blockquote cite="mid453E3DFF.7020902@verisign.com" type="cite">
<pre wrap="">
A while back I drafted some security profiles [1] that deals
with (1.) and (2.) The enforcement (3.) is difficult to
mandate on the OpenID protocol level, but could be handled by
IDP and RP applications.
I realize these profiles are not complete, but I think they
are a reasonable starting point for our discussion.
</pre>
</blockquote>
Very interesting...Is this going to be part of the 2.0 specs (or
whatever it is going to be), or is this an optional extension really?<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>