<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Greg,<br>
<br>
First of all this is an interesting question. Please allow me to
provide my opinion, which is obviously mine and not that of Meng Weng
Wong.<br>
<br>
Greg Hewgill wrote:
<blockquote cite="mid:20070718235436.GA75867@occam.hewgill.net"
type="cite">
<pre wrap="">
How would a whitelist of providers work for people like myself who run
their own OP? </pre>
</blockquote>
The reputation service (of whitelists) I envision would allow you to
register your IDP server in a basic configuration. No strings attached.<br>
<blockquote cite="mid:20070718235436.GA75867@occam.hewgill.net"
type="cite">
<pre wrap="">In my case, my OP is used only by me and the details of
the authentication method are not public. Would there be any provision
to get such an OP onto any kind of whitelist?
</pre>
</blockquote>
If you would like to have attributes added such as you mentioned:
authentication methods, SSL or other measures I guess you would have to
disclose them to the representative of the reputation service.
Obviously certain aspects such as SSL can be verified without having to
disclose anything except the URL (which is supposed to be know anyway).<br>
<blockquote cite="mid:20070718235436.GA75867@occam.hewgill.net"
type="cite">
<pre wrap="">
A whitelist that is based on the OpenID itself, rather than the
associated OpenID Provider, wouldn't even raise this question.</pre>
</blockquote>
How would you suggest to review/verify/control each and every OpenID
user? It might be possible in some sort of socialized recommendation
system, which could give some indication about the OpenID itself, but
OpenID providers could be measured according to the extensions<br>
<br>
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-assertion-quality-extension-1_0-03.html">http://openid.net/specs/openid-assertion-quality-extension-1_0-03.html</a><br>
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html">http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html</a><br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>