<HTML dir=ltr><HEAD></HEAD>
<BODY>
<DIV id=idOWAReplyText97242 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Realm discovery has been repeatedly articulated as being necessary on security grounds. Technically, tts a "control system" lightly discussed in such terms since we are all so anti-control, here!</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>But the topic reflect a more interesting set of issues than merely the internal consistency of the 2.0 protocol. The obligation to do RP discovery is part of the trust signaling apparatus. Similar obligations on consumer to repeat discovery, when an OP changes the form of the claimed id (to a public key say) are not widely understood, I strongly suspect.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>The way that openid address trust formation is generally enticing. Its upside down, inside out, and the wrong way round. Therefore, I like it, as these properties mean it can scale. Once bootstrapped with urls, the infrastructure can then all be re-applied to any number of id forms as they emerge. This is an essential feature of an web infrastructure - and a obvious boon to most of its users</FONT></DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2></FONT> </DIV></DIV>
<DIV id=idSignature91468>
<DIV><FONT face=Arial color=#000000 size=2><SPAN style="FONT-SIZE: 7.5pt">_________________________<BR></SPAN><B>Peter Williams<BR></B></FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> SitG Admin<BR><B>Sent:</B> Fri 4/18/2008 6:55 PM<BR><B>To:</B> Allen Tom; general@openid.net<BR><B>Subject:</B> Re: [OpenID] Yahoo hijacking?<BR></FONT><BR></DIV>
<DIV><PRE style="WORD-WRAP: break-word">>This realm discovery feature was added to patch a security hole in
>OpenID 1.1, and is one of the main reasons why Yahoo does not
>support OpenID 1. More details here:
>
>http://openid.net/pipermail/security/2007-February/000241.html
Is this feature exclusive to Yahoo, or is it part of the 2.0 specs?
-Shade
_______________________________________________
general mailing list
general@openid.net
http://openid.net/mailman/listinfo/general
</PRE></DIV></BODY></HTML>