<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dan Lyke wrote:
<blockquote cite="midop.thyhdfxpyokp2o@localhost" type="cite">
<pre wrap="">
I've already laid out my reasons why I believe that authentication of
the user to the Identity Provider is between the user and the Identity
Provider.....that's my own business.
</pre>
</blockquote>
No it's absolutely not! Because any RP is going to rely on that login
facility!
<blockquote cite="midop.thyhdfxpyokp2o@localhost" type="cite">
<pre wrap=""><!---->
No, it's not. In fact the user URI is published widely and isn't a
secret at all. I use <a class="moz-txt-link-freetext" href="http://danlyke.livejournal.com/">http://danlyke.livejournal.com/</a> and
<a class="moz-txt-link-freetext" href="http://danlyke.pip.verisignlabs.com/">http://danlyke.pip.verisignlabs.com/</a> </pre>
</blockquote>
Too bad, now anybody can point an http sniffer to your IDP server and
wait patiently for the user/pass pair...However I suspect, that you mix
up the IDP and RP here....The above looks more like an IDP ;-)<br>
<blockquote cite="midop.thyhdfxpyokp2o@localhost" type="cite">
<pre wrap="">So to be *very* specific:
</pre>
</blockquote>
The fears are the same fears that any bank, credit card company, online
shop or about anybody else running secured servers, has...<br>
<blockquote cite="midop.thyhdfxpyokp2o@localhost" type="cite">
<pre wrap="">#1 means that all communication between the Relying Party and the IdP
Endpoint URL and the Claimed Identifier would need to be HTTPS.
</pre>
</blockquote>
Yes!<br>
<blockquote cite="midop.thyhdfxpyokp2o@localhost" type="cite">
<pre wrap="">
My guess is somewhere between "snowball's chance in hell" and "zero",
because that would mean allocating a separate IP address to all
LiveJournal users (<a class="moz-txt-link-freetext" href="http://username.livejournal.com/">http://username.livejournal.com/</a>) or PIP users
(<a class="moz-txt-link-freetext" href="http://username.pip.verisignlabs.com/">http://username.pip.verisignlabs.com/</a>),
</pre>
</blockquote>
Wrong...An IDP will install a wild card certificate for the user area,
i.e. CN=*.pip.verisignlabs.com<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>