<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Simon Willison wrote:<br>
<blockquote
cite="mid:a3b4f3b60707190406q254941e8i9d1d0f69d8414b26@mail.gmail.com"
type="cite">They are all examples of public sites that have chosen to
allow OpenID
<br>
users from any identity provider to associate their OpenID with an
<br>
account on the site and use it to sign in as an alternative to a
<br>
username and password. I'm interested to know if you think this is an
<br>
unsuitable use for OpenID in its present form - and if you do, what
<br>
your reasons are.
<br>
<br>
</blockquote>
They are relying parties in relation to OpenID providers and I'm sure
that they made a decision if and how they want to rely on them. Nothing
wrong with that and I'm not really concerned about RPs which made that
decision. This is obviously all fine as long as it serves their purpose.<br>
<br>
I'm concerned more about RPs which must or want to have higher
requirements, for which David compiled some useful extensions. However
those extensions are pretty meaningless if they can not be enforced and
traced back to some verifiable source.<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>