<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Nat,<div><br></div><div>I would agree that some architectural work would help to make OpenID sufficiently secure for higher-valued transactions. However, while the flows could be better secured, and Cardspace is a huge help for phishing protection, a lot of what I would consider additional "security" is an ability for providers to recognize and trust each other. That mostly involves third-party reputation and vetting services.</div><div><br></div><div>OASIS is doing important work here, as you know of course, but it will be gradual and still require integration with OpenID. I'd certainly be interested in helping out if there were such a working group formed and the IPR process solidified.</div><div><br></div><div>Take care,</div><div>Nate.<br><div><div><br><div><div>On 29 Jul 2008, at 03:06, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Is there a security committe or something like that in the community?</font></p> </blockquote></div><br></div></div></div></body></html>