<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Johannes Ernst wrote:
<blockquote cite="midC4650EDC-228E-4F99-A473-79E4E8527353@netmesh.us"
type="cite">I'm one of the guys who actually maintains an ACL (Access
Control List) based on OpenID identities. The process works like this:
<br>
- Customer: hey, I'd like access to your website
<br>
- Me: sure, send me your OpenID
<br>
- Customer: foo.bar.com
<br>
- Me: adding <a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a> to the ACL
<br>
- Customer: hey, I tried but it doesn't work
<br>
- Me (diagnosing): that's because you entered '<a class="moz-txt-link-freetext" href="https://foo.bar.com/">https://foo.bar.com/</a>'
and not '<a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a>".
<br>
<br>
This happens in a surprisingly large number of cases.
<br>
<br>
No user seems to put any significance into the http vs. https as part
of their identifier; even the people who do have the technical
understanding to distinguish the two tend to fail understanding that
within this community, we treat them as different identities.
<br>
</blockquote>
I think that treating these as different identities would be a fairly
major potential impersonation security problem.<br>
<blockquote cite="midC4650EDC-228E-4F99-A473-79E4E8527353@netmesh.us"
type="cite"><br>
I'd like to revisit this issue, as actual user behavior as I'm seeing
it tends to conflict with the assumptions we made when defining these
are two different identities. Specifically, I'd like the spec to say:
<br>
<br>
"Identifiers distinguished only by the 'http' vs. 'https' in the
protocol part of the URL (e.g. '<a class="moz-txt-link-freetext" href="https://foo.bar.com/">https://foo.bar.com/</a>' vs
'<a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a>") refer to the same identity. Conforming
implementations must ensure that attackers cannot use an identifier
distinguished only by the protocol to impersonate a victim."
<br>
<br>
<br>
<br>
<br>
<br>
<br>
Johannes Ernst
<br>
NetMesh Inc.
<br>
<br>
<br>
<br>
<hr size="4" width="90%"><br>
<center><img src="cid:part1.04040000.05060505@acm.org"></center>
<p><br>
</p>
<hr size="4" width="90%"><br>
<center><img src="cid:part2.07070109.02040205@acm.org"></center>
<p> <a class="moz-txt-link-freetext" href="http://netmesh.info/jernst">http://netmesh.info/jernst</a>
<br>
<br>
</p>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
<br>
</body>
</html>