<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
And now a little more serious: <br>
<br>
Johnny Bufu wrote:
<blockquote cite="mid:63508706-DD4B-4447-B593-0B586B5FEDBF@sxip.com"
type="cite"><br>
On 28-Aug-07, at 12:03 PM, Gerald Beuchelt wrote:
<br>
<blockquote type="cite">If I am reading this correctly, then (one of)
the biggest difference between a SAML payload and an OpenID token is
that additional user-specific communication between the RP and the
OP/STS (in accordance with the OpenID specs).
<br>
</blockquote>
<br>
Yes and no. It's additional only if with a SAML token you don't
consider validating the token issuer.
<br>
<br>
</blockquote>
Which is the default more for the Infocard system and the only one in
line with Kim's laws. <br>
<br>
<blockquote cite="mid:63508706-DD4B-4447-B593-0B586B5FEDBF@sxip.com"
type="cite">I could say that disclosing the visited site to the STS/OP
is justifiable, because that's how OpenID works.
<br>
<br>
The Infocard technology does allow this (managed cards with auditing
mode enabled, and we're requiring it in the OpenID Information Cards
spec). While aiming for the most privacy-protecting features, the
Infocard specs defines and allows this use case as well.
<br>
<br>
</blockquote>
Yes, but if you take a look at least at Kim's blog, you will find that
he is quite uncomfortable with it: <br>
<br>
<blockquote><i>"In other words, with auditing mode,
a great deal of trust must be placed in the identity provider. It
should only be used in the contexts where it is really required."</i><br>
</blockquote>
<br>
That is not exactly a strong endorsement of this more of operation. <br>
<blockquote cite="mid:63508706-DD4B-4447-B593-0B586B5FEDBF@sxip.com"
type="cite"><br>
<blockquote type="cite">If the OpenID token changes this kind of
behavior, this should be very clearly indicated to the user before
he/she can use it.
<br>
</blockquote>
<br>
It doesn't *change* this behavior; it uses this option out of a set.
<br>
<br>
And yes - when issuing an OpenID Information Card the OP/STS should
make it clear that it's an "auditing" one (just in case that the
"auditing" aspect of OpenID is not clear to the Infocard user).
<br>
<br>
Not sure if there are any Infocard UX recommendations here.
<br>
<br>
</blockquote>
If not, there should be some. <br>
<br>
<blockquote cite="mid:63508706-DD4B-4447-B593-0B586B5FEDBF@sxip.com"
type="cite">
<blockquote type="cite">The other problem that I still seem to have
with this spec is that I do not exactly see what benefits over SAML it
really has.
<br>
</blockquote>
<br>
What are the benefits of SAML tokens over OpenID tokens? :-)
<br>
</blockquote>
The ability to not run in auditing mode, for starters. <br>
<br>
Best, <br>
<br>
Gerry<br>
<br>
</body>
</html>