<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
James A. Donald wrote:<br>
<blockquote cite="mid453D7024.6090505@echeque.com" type="cite">Those
arguing against SSL would have a point if they
<br>
argued cost to benefit, rather than arguing we don't
<br>
need security. If we don't need security, we don't need
<br>
OpenID.
<br>
</blockquote>
Absolutely... :-)<br>
<blockquote cite="mid453D7024.6090505@echeque.com" type="cite">If SSL
and DNSSEC does not do it, there should be some
<br>
way of doing it, and at substantially lower cost.
<br>
</blockquote>
As someone else pointed out already: Serious sites are going to use SSL
even if not required by the specs and by reading
<a class="moz-txt-link-freetext" href="http://openid.net/pipermail/specs/2006-October/000463.html">http://openid.net/pipermail/specs/2006-October/000463.html</a> one could
almost say, that it will be a de-facto standard anyway....So why not
making it one anyway? At least it would be defined and make the spec
itself stronger...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>