<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
OK, let me explain, what my thoughts on this really are:<br>
<br>
Supposed this protocol should be used in the future for more serious
stuff than forums and blogs, than I suggest to define this NOW. Taking
adoption into account and supposed, that the specifications can provide
what's needed, than in a year or two this can be already reality...<br>
<br>
BUT: Supposed I would give access to critical parts of a certain area
via this protocol/specifications and something happens, i.e. precious
data gets compromised for example, than I am responsible for
this...Now, if I'm the one, who has to authorize the use of this
specific protocol (openid) and this protocol doesn't provide the
required protection, than I'll never be able to do so....<br>
<br>
Now lets break this down very simply:<br>
<br>
- If an IDP (perhaps you) is not required to run in secured mode, than
the user specific data might get compromised and the chances are too
high...I can't allow access to critical area, where a user/password
pair might have been transfered in plain...<br>
<br>
- If a RP isn't required to run in secured mode, than chances are, that
half of the secret of the user might get compromised (i.e. the user URI
is half of the secret).<br>
<br>
- If a RP might transfer or receive data unsecured (and even
unencrypted) between the IDP and itself, than again part of the data
can get compromised.<br>
<br>
Summary:<br>
<br>
Since I have to trust on others in order to make use of this
single-sign-on network, I must be sure, that none of the above can
happen, otherwise I can't delegate to a third party and will remain as
it is...I guess, that I'm not the only one who thinks like this, but
every serious IT manager will make the same decision.<br>
<br>
That's why, I see it crucial, that a certain standard has to be
required! I'm not even talking about better protection of the user/pass
pair, which is another issue in itself, but really some of the basic
conditions as I see it....<br>
<br>
Hope this helps somewhat...<br>
<br>
Dan Lyke wrote:
<blockquote cite="midop.thydnuimyokp2o@localhost" type="cite">
<pre wrap="">On Tue, 24 Oct 2006 17:48:17 -0700, Eddy Nigg (StartCom Ltd.) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Well, I think we all tried...We provided an existing and common
solution, which could provide one/another line of defense...
</pre>
</blockquote>
<pre wrap=""><!---->
For the second time: Can someone, please, tell me exactly what this
other line of defense is protecting against?
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>