<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Andrew,<div><br></div><div>Absolutely, and in some situations that argument would be valid. Depends what you're trying to protect. We worry principally about student data because we're custodians of that information and take our (FERPA) duty seriously. It's a bigger issue for me than a compromised machine snooping courseware, to cite a common application. I'm not sure how EU privacy laws would be interpreted here.</div><div><br></div><div>In other environments, the servers and their data are definitely more sensitive than personal data. These environments tend to have strong authentication and closed networks. Other networks can afford to be more open and expediency is favored.</div><div><br></div><div>The protocol could support many choices, but that complicates development and deployment. Which environment(s) does OpenID want to live in, and what does that imply here? I'd use that to inform choices here (and on a security committee, if convened).</div><div><br></div><div>Thanks for your deep consideration,</div><div>Nate.</div><div><br><div><div>On 3 Aug 2008, at 23:59, Andrew Arnott wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; ">Very good point, Nate. I hadn't considered #2. Although one might argue that once spyware is on the computer, all confidentiality bets are off period anyway.<br></span></blockquote></div><br></div></body></html>