<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Dimitry,<br>
<br>
Dmitry Shechtman wrote:
<blockquote cite="mid:002101c7c78f$02af6b90$b0db17ac@a9a181c8860745f"
type="cite">
<div class="Section1">
<div>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;">I’ll have to
disagree. E.g. although
MyOpenID.com is generally known as trustworthy (it even has client
certificates),
nothing would prevent a spammer from manually registering an account
with
MyOpenID.com to use it to automatically post everywhere.</span></font></p>
</div>
</div>
</blockquote>
That's correct, but my logic says:<br>
<br>
1.) The IDP operates according to established rules (He's the trust
anchor for the RP).<br>
2.) The RP may require to have identities validated (according to
current draft extensions which can be further extended).<br>
<br>
Now, if I can trust the IDP, i.e. he has undergone some verification
process and is known to conform to a certain standard (which can
include various different options, like A, B and C), the RP can request
to have the IDP to be either A, B or C (or any combination thereof).
Further the RP can require to have identities for example 1) not
validated, 2) validated by friends (web-of-trust), 3) validated by a CA
(different Class levels as well) and so on...<br>
<br>
In that respect, the IDP makes a decision which services he wants to
provide and the RP can make a decision, which requirements he wants to
apply for the login facility. For example, the RP which operates "Super
Cool Forum" may set his requirements very low (or no requirements at
all), whereas a wiki for a closed group on future w3c standards wants
to set its requirements high (validated identities, IDP verified and
SSL secured, encrypted storage of data etc...).<br>
<br>
Obviously an RP can't blame anybody if nobody post to the forum if he
requires to have the IDP to be rigorous checked and the identities
class 3 CA validated ;-)<br>
<blockquote cite="mid:002101c7c78f$02af6b90$b0db17ac@a9a181c8860745f"
type="cite">
<div class="Section1">
<div>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p> </o:p></span></font></p>
<p class="MsoNormal" style="margin-left: 36pt;"><font color="black"
face="Times New Roman" size="3"><span style="font-size: 12pt;">Second,
there needs to be
a defined policy and criteria and not "<i><span
style="font-style: italic;">Identifiers issued by <a
moz-do-not-send="true" href="http://www.jkg.in/openid/">http://www.jkg.in/openid/</a>
will definitely be there</span></i>". Or in other words, what makes an
IDP
worthy to be used by default for 99% of the relying parties? How do we
protect OpenID, its RPs and effectively also all other end users...?<br>
<br>
</span></font><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;">Well, if
such a policy and/or criteria
could be easily defined (and widely adopted), there would be no need
for a central
black/white list.</span></font></p>
</div>
</div>
</blockquote>
Right! This is what I try to do...lets combine your effort and that of
others and form a standard, policy and criteria which would fit all of
us...<br>
<blockquote cite="mid:002101c7c78f$02af6b90$b0db17ac@a9a181c8860745f"
type="cite">
<div class="Section1">
<div>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p> </o:p></span></font></p>
<p class="MsoNormal"
style="margin-right: 0cm; margin-bottom: 12pt; margin-left: 36pt;"><font
color="black" face="Times New Roman" size="3"><span
style="font-size: 12pt;">Third, OpenID isn't yet adopted widely, but
already
there are various black and white lists and other efforts cruising
around....<o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;">Are there?
In that case, I should stop
working on mine.</span></font></p>
</div>
</div>
</blockquote>
1.) You have one...<br>
2.) Here another one: <a class="moz-txt-link-freetext" href="http://simonwillison.net/2007/Jan/22/whitelisting/">http://simonwillison.net/2007/Jan/22/whitelisting/</a><br>
3.) At <a class="moz-txt-link-freetext" href="http://openid.barnraiser.net/">http://openid.barnraiser.net/</a> they try to achieve this as well
in a different way...<br>
<br>
All of them posted within the last 48 hours to this list!<br>
<blockquote cite="mid:002101c7c78f$02af6b90$b0db17ac@a9a181c8860745f"
type="cite">
<div class="Section1">
<div>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;"><o:p> </o:p></span></font></p>
<p class="MsoNormal"
style="margin-right: 0cm; margin-bottom: 12pt; margin-left: 36pt;"><font
color="black" face="Times New Roman" size="3"><span
style="font-size: 12pt;">Wouldn't it be better to create one combined
effort by
the community with clear policies and definitions? I'm not saying that
your
efforts are useless, but isn't this the wrong direction? Is this the
result of
the unwillingness of the OpenID leaders (notably the people listed
here: <a moz-do-not-send="true"
href="http://openid.net/wiki/index.php/OpenID_Foundation/Board">http://openid.net/wiki/index.php/OpenID_Foundation/Board</a>
) to address it?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font color="navy" face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial; color: navy;">If you
believe my efforts are going in the
wrong direction, please by all means elaborate on what you see as the
right
one. As I already mentioned in previous discussions, I believe the
OpenID Foundation
shouldn’t be in charge of a central black/white list. I completely
agree
with the board’s (in)decision, as it helps keep OpenID as decentralized
as possible.</span></font></p>
</div>
</div>
</blockquote>
Personally I don't see a problem with it. I'd love to rely on an effort
lead by the OpenID Foundation. Remember, it's the RP which makes the
decision if to use it and which requirements he wants to have applied.
In the same way however the community can start its own body for this
purpose, which is fine with me too...I'm interested in the end result
and willing to contribute to that end.<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>