<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hans Granqvist wrote:
<blockquote cite="mid453EB36B.7070309@verisign.com" type="cite">
<blockquote type="cite">A. It's not complete
<br>
</blockquote>
What is missing? (Please don't respond with the sections that
<br>
are already specified as TBD.)
<br>
</blockquote>
Nono...just stated the fact, that it's not completed yet and some parts
are marked as todo...That's OK!<br>
<blockquote cite="mid453EB36B.7070309@verisign.com" type="cite">
<blockquote type="cite">B. It has a geeky approach (which is really
OK), but I'd prefer a clear cut model of security defined, i.e. only
options which define certain levels, but not unsecured ones
<br>
</blockquote>
I don't understand. Can you give an example on what you'd expect?
<br>
</blockquote>
The possible options are some ten fields, which require answers from
one or both sides. This might be OK for me (you and a few others) and
provides flexibility, however I'm not sure, if it needs this
flexibility at all...Why not define ONE secured mode, known by all
parties and be done with it? More than that, the user who should care
most about the selections really, doesn't seem to have a say...<br>
<br>
I really would say, that there should be only a secure or unsecured
model (preferable the unsecured one not being usable) and the settings
just should be defined, like:<br>
<br>
1.) Yes<br>
2.) No<br>
3.) HTTPS / XRDS)<br>
4.) No<br>
(5. Yes)<br>
6.) Yes<br>
7.) DH-SHA1/DH-SHA256<br>
......<br>
<br>
If there would be only ONE definition, than you'd opt for the best
available one...The optional fields would be reduced to about two or
three perhaps...<br>
<br>
<blockquote cite="mid453EB36B.7070309@verisign.com" type="cite">I want
these profiles to be usable.
<br>
</blockquote>
They are usable!<br>
<blockquote cite="mid453EB36B.7070309@verisign.com" type="cite">Both
the IDP and the RP can advertise adherence to specific profiles.
<br>
</blockquote>
And who wins? I was afraid of that one...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>