<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hans Granqvist wrote:
<blockquote
cite="mid:c47f68be0801152150s1afcdbe5s92b516288928f36a@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">If you are concerned about the latter attack, then you can either enter
<a class="moz-txt-link-freetext" href="https://">https://</a> explicitly or wait until you get to your IdP and verify its SSL
cert to make sure you haven't been tricked.
</pre>
</blockquote>
<pre wrap=""><!---->
Of course, a pretty simple attack is RP getting a domain, </pre>
</blockquote>
Don't you refer here to the ID provider instead the relying party (RP)?
<blockquote
cite="mid:c47f68be0801152150s1afcdbe5s92b516288928f36a@mail.gmail.com"
type="cite">
<pre wrap="">
OpenID aware browsers or add-ons could help. OPs that use
OTPs, challenge response, biometrics, etc. could also help. But
is it even feasible to force their use?</pre>
</blockquote>
According to the specs an RP can request minimum requirements such as
the ones mentioned above, however if there is a rough ID provider
somewhere, he can reply with the matching response anyway. So there
isn't much use for it except in case the RP limits the ID providers he
wants to work with and knows about their "trustworthiness", I
think....The question is really who needs to be protected by whom?!<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>