<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Peter & others,<div><br></div><div>I'm not criticizing the specs themselves, though I'm not sure what this use case was. I'm just having major cognitive dissonance issues between the idea that authentication is optional, that trust in the OP is irrelevant, and that we can put in place a trust fabric that's good enough for most enterprise applications. I'm attempting to reconcile these bits and pieces.</div><div><br></div><div>I think the optional communities-of-interest is a great start towards that, which is why I'm interested in them. However, given recent events, I'd like to watch the XRI situation develop a bit before having much opinion about it.</div><div><br></div><div>Thanks for the perspective; it's really useful,</div><div>Nate.<br><div><br><div><html>On 23 May 2008, at 16:47, Peter Williams wrote:</html><br class="Apple-interchange-newline"><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">You cannot read the OpenID specs rigorously, Nate. The security engineering terminology is all over the place. Go for the thrust, not the literal meaning. OpenID4 can go to IETF on day, like SSL3 did, and defense types there can spend another 10 years years rewriting it all, if they want, once its widely adopted.</font></p> </blockquote></div><br></div></div></body></html>