<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Eric Norman wrote:
<blockquote cite="mid:a14d759f2f5fca45087800d6b50a0875@doit.wisc.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">
OpenID is currently completely decentralized and no requirements are
set by anybody (yet). When comparing to PKI, anyone can run his own
"CA" in the OpenID world. Like Cardspace and self-run IDPs, they are
effectively like self-signed certificates. A relying party can choose
to trust them but nothing has been verified or guarantied in any form
(not even the integrity of the authentication process).
</pre>
</blockquote>
<pre wrap=""><!---->
Seems like a fairly accurate description to me.
</pre>
</blockquote>
Glad to see you agree! Perhaps a point to add is, that not humans are
making the decision on a case to case basis (as when visiting a web
site, but rather dumb web sites are the relying party). <br>
<blockquote cite="mid:a14d759f2f5fca45087800d6b50a0875@doit.wisc.edu"
type="cite">
<pre wrap=""><!---->
It sounds like you want to re-invent policy OIDs
and their accoutrements.
</pre>
</blockquote>
:-( Well, not really....but other projects went a similar path as I
suggested. It could be implemented and kept simple, but effective...and
in an open and free spirit as well.<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>