<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Peter,<br>
<br>
I want to concentrate on the third part, which doesn't mean, that what
you said in the first two is less important. Just the third section
interests me most ;-)<br>
<br>
Peter Williams wrote:<br>
<blockquote
cite="mid:18498B6C4F691545B050D6A531BA44950297B342@rapmsg02.rapnt.com"
type="cite">
<pre wrap="">3. We also have to look increasingly carefully at the exposition of the core design philosophy. If one evaluates the primary claim of the movement - as one day a Common Criteria evaluator MUST - then we see that "Opened is completely decentralized meaning that anyone can choose to be a Consumer or Identity Provider without having to register or be approved by any central authority" is a somewhat "vacuous" central claim The same is true for PKI, in practice. The same is true for SAML, in practice. The same is true for SSL, in practice. The same is true for inter-domain web cookies achieving SSO, in practice. Its even true for federation-centric schemes like Shibolleth, that also admit and greatly benefit from bilateral optouts by site from the centralized policy management regimes. So... So what! OpenID?
</pre>
</blockquote>
Let me pick your PKI example, since I'm most familiar with it. PKI is
decentralized in theory, since everybody can operate a certification
authority (CA) and issue certificates. Self-signed x.509 certificates
are most common. In practice however software vendors (OS, browser,
mail clients) are the supervisors - mostly through a third party audit
requirement. However this practice has come a long way from the
Netscape days of a monopoly on digital certification by Verisign and
later Thawte, through the somewhat opening by Microsoft's Internet
Explorer up to today, where the North-American Webtrust isn't the only
governing body anymore - with much help from Mozilla.<br>
<br>
OpenID is currently completely decentralized and no requirements are
set by anybody (yet). When comparing to PKI, anyone can run his own
"CA" in the OpenID world. Like Cardspace and self-run IDPs, they are
effectively like self-signed certificates. A relying party can choose
to trust them but nothing has been verified or guarantied in any form
(not even the integrity of the authentication process). For me as
relying party running a forum or web log, this is not really
assuring...not to speak about other potential login facilities.<br>
<br>
I suggested a while ago to form a body which would provide to relying
parties a service of supervision of IDPs. This body could define the
requirements of IDPs and the verification thereof, which would assure
to RPs adherence to that defined standard to a great extend. I'd
envision this body to be an open and free foundation. I'd have another
few ideas about how such a body could function and look, and allow any
sincere IDP to operate his server. RPs could then choose to require any
IDP to be verified by that body and block all the others (not a MUST,
but an OPTION). Obviously this would prevent the mess of managing
black lists as it's happening with mail servers today or other
measures! <br>
<br>
Another thought is also, that since there is a business interest in
OpenID I don't expect OpenID to remain decentralized and open as it is
today. In theory it will remain an open standard, in practice however
not! Currently the free adoption and participation of a wide community
serves the interest of everybody involved, however a day might come
when this will change. Because for obvious reasons, since nobody can
rely on OpenID seriously, there will be strings attached in the future
- and as it will happen, it will serve the various business interests
too. I'm just speculating this scenario, but it's a likely possibility.<br>
<br>
Therefore, a free and open supervisory and standards body for OpenID
operators, which would close the gap of security requirements (and
trust) of the current decentralized scheme, would guaranty the
continued freedom of operators and relying parties alike. If adoption
of such a body would make it into the community as a de-facto standard
(and must-have), everybody making use of OpenID might gain from various
perspectives - notably the OpenID standard itself, as it would
strengthen its reliability tremendously.<br>
<br>
Else? Else I expect the same to come from a completely different
direction, but with no influence from the enthusiastic OpenID community
and early adopters.<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>