<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Nov 26, 2007, at 1:45 PM, Dick Hardt wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"> <div><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">A search of openid on the site usaa.com gave no results:</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" style="font: 12.0px Helvetica"><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://www.google.com/search?q=openid+site%3Ausaa.com">http://www.google.com/search?q=openid+site%3Ausaa.com</a></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br class="webkit-block-placeholder"></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">That wiki entry looks over a year old, which also then predates PAPE. It is not clear, but it would seem that whoever wrote the entry as thinking that USAA would be issuing the OpenID.</div></blockquote><div><br class="webkit-block-placeholder"></div>A friend of mine who has an account with them said the OpenID dialog only comes up if you have an account with them and selected the option. It's definitely implemented and running right now.</div><div><br><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">Looks like Terry accurately addressed your other comments.</span></div><div><br class="webkit-block-placeholder"></div></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Personally, I think anyone that used OpenID Authentication for financial transactions would be crazy. I think we need to move OpenID to a new level for it to be used for transactions any more sensitive then social neworking and blog commenting.</div></blockquote><br></div><div>So your online identity, who the world sees you as, your posts around the net, your online 'reputation' really, is not as important as securing a financial transaction? I personally would consider it incredibly damaging to have someone running around the net who hijacked a cookie off me. Sure the person hijacking my OpenID can't access my financial data, but I consider my online reputation rather valuable as well.</div><div><br class="webkit-block-placeholder"></div><div>It just depresses me a bit that this seems to come down to, "OpenID, use it if you need something slightly better than anonymous comments". Why bother with being phishing resistant, or addressing any of the other security issues that OpenID has been attempting to tackle, if its just to secure some blog comments?</div><div><br class="webkit-block-placeholder"></div><div>At the very least, I think it would be prudent in light of this, to have a nice big disclaimer on the openid.net developers page clearly saying, "OpenID is for things of little value, like blog comments and sites that never touch money." I'm speaking here in utter frustration of having spent quite a bit of time going over PAPE, and OpenID 2.0 with the apparently crazy belief that OpenID is suitable for more than merely blog commenting.</div><div><br class="webkit-block-placeholder"></div><div>Cheers,</div><div>Ben</div></body></html>