On 7/12/07, <b class="gmail_sendername">Peter Williams</b> <<a href="mailto:pwilliams@rapattoni.com">pwilliams@rapattoni.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
[...]<br><br>Now, how can we do this with OpenID?<br><br>The klutzy way is to make that mega-RP into an mega-IDP, upsetting the balance of power and creating a centralized monster. That prospect will cuase a political backlash, similar to the ccounter-current which killed-off voluntary PKI adoption.
</blockquote></div><br>It doesn't necessarily have to be the mega-RP becoming a mega-IDP to be klutzy. Just having the mega-RP rely only on mega-IDPs may be klutzy enough. I do think that sites with more sensitive information will be more likely to rely only on mega-IDPs, whether the mega-IDP is themselves or a third-party.
<br><br>One issue with mega-IDPs is that they will consolidate information about a user's logins. Some people don't mind that but others are more concerned about their privacy.<br clear="all"><br>In the PKI world, the mega-CAs are embedded in the browsers that automatically trust those CAs on behalf of the users, with most users not even realizing the browser ISV is making a trust decision for them. I've been wondering if there's anything wrong with CAs like CAcert that provide free certs to just provide encryption, as opposed to authentication. I see mega-IDPs like mega-CAs and do-it-yourself IDPs like CAcert.
<br><br><br>-- <br>John Wang<br><a href="http://www.dev411.com/blog/">http://www.dev411.com/blog/</a>