<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Per Ekström wrote:<br>
<blockquote
cite="mid:16726be0801311212x423c93c2mf59bcae81dc33168@mail.gmail.com"
type="cite"><br>
My first question is regarding the Phishing attacks that are mentioned
at Wikipedia [1] - Are they still valid or is it just FUD that has been
floating around since an old version of the standard?<br>
</blockquote>
I guess that's correct, as with anything that uses a user name and
password for authentication. There is no difference of a phishing
attempt of an online banking web site and an IDP, with different
results perhaps. Phishing of banking sites will cost somebody money,
whereas with OpenID it might be used for spamming and identity theft
(whatever that implies).<br>
<br>
There are however secure methods for authentication other than
user/pass pairs and OpenID has an draft extension for this:
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html">http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html</a><br>
<blockquote
cite="mid:16726be0801311212x423c93c2mf59bcae81dc33168@mail.gmail.com"
type="cite"><br>
And second - While I know Man-In-The-Middle between user and
OpenID-provider is quite easy to stave off, what about OpenID-provider
and the website I'm trying to log in to? Whenever man-in-the-middle
discussion about this appears, it's always in the form of
User-to-OpenID-Provider, not the other way around.<br>
</blockquote>
The RP can require SSL of only known CAs. This should solve this
concern mostly. But the provider will not send the authentication bits
in any case, in most cases only a yes/no/cancel reply.<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>