<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Johannes,<br>
<br>
You provided Amazon your CC number, CC Security code, and a billing
address that matches your CC's billing address. That seems to be more
than what most stores would require if you used your card in person at
the store.<br>
<br>
Amazon can also store your CC number for future use, and your stored CC
number can be used to authorize purchases by just entering your Amazon
password. I would think that most OPs would want nothing to do with
tying an OpenID to a stored credit card. This is actually the use case
that I'm most concerned about.<br>
<br>
Likewise, the level of security to login to a financial site is quite a
bit higher than what's required to login to most consumer websites. For
instance, financial sites should tie credentials to IP addresses,
require strong passwords, have short lived sessions, etc. Also,
decently sized high value sites would also require SOX compliance and
all the baggage that comes with that.<br>
<br>
Allen<br>
<br>
<br>
<br>
Johannes Ernst wrote:
<blockquote cite="mid:453D8FD4-BCC7-492E-A45C-D87EA438CC69@netmesh.us"
type="cite">I'd like to take issue with the following statement that's
being made all too often: [not picking on anybody in particular, just
"established wisdom"]
<br>
<br>
<blockquote type="cite"> the security requirements to authorize
<br>
financial transactions are much higher than the requirements to login
to
<br>
most consumer oriented websites.
<br>
</blockquote>
<br>
Ahem, no?
<br>
<br>
Just today, I ordered something from Amazon with no credential at all,
just my credit card number and "security code" (also printed on the
card) that every waiter knows in every restaurant I have ever been to.
<br>
<br>
This is *less* security than username and password, not "much higher"
as is generally stated.
<br>
<br>
Now, you can quibble with my statement, but in order to do so, we need
to put a whole lot of if-then-else's around when higher security is and
isn't required. The fact of the matter is that less security than
OpenID Auth was perfectly acceptable for parties that know what they
are doing (Amazon, Visa etc.) for a transaction worth 100's of dollars.
<br>
<br>
So, let's beware of blanket statements re security requirements ...
<br>
<br>
Cheers,
<br>
<br>
<br>
<br>
Johannes.
<br>
<br>
<br>
<br>
Johannes Ernst
<br>
NetMesh Inc.
<br>
<br>
<br>
<br>
<hr size="4" width="90%"><br>
<center><img src="cid:part1.00070508.04040000@allentom.com"></center>
<p><br>
</p>
<hr size="4" width="90%"><br>
<center><img src="cid:part2.00030805.06060708@allentom.com"></center>
<p><a class="moz-txt-link-freetext" href="http://netmesh.info/jernst">http://netmesh.info/jernst</a>
<br>
<br>
</p>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
<br>
</body>
</html>