<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I've had some chats about this, and it would seem one problem would be that if an OP does not require HTTPS-only, a user using their HTTPS identifier exclusively would suddenly become vulnerable because if their HTTP identifier were comprised, their entire account would be.<div><br></div><div>-Sam</div><div><br class="webkit-block-placeholder"></div><div><div><div>On Aug 11, 2008, at 2:44 PM, Gerald Beuchelt wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"> <div bgcolor="#ffffff" text="#000000"> In light of the recent security issues, we have decided to <a href="http://blog.beuchelt.org/2008/08/11/Securing+OpenIDWork+Again.aspx">improve the security</a> of our OpenID@Work service/experiment. <br> <br> In a nutshell, we would like to require all users to use <a class="moz-txt-link-freetext" href="https://">https://</a> prefixed OpenID identifier, so that RPs normalize and discover over HTTPS, instead of HTTP. The obvious issue is that -- to my knowledge -- <a class="moz-txt-link-freetext" href="https://openid.sun.com/user">https://openid.sun.com/user</a> != <a class="moz-txt-link-freetext" href="http://openid.sun.com/user">http://openid.sun.com/user</a>. At this point I see an opportunity for the OpenID community to address some of the recent vulnerabilities: if RPs started to recognize both <a class="moz-txt-link-freetext" href="https://">https://</a> and <a class="moz-txt-link-freetext" href="http://">http://</a> prefixed identifiers as the same entity, or at least allowed easy linking, users could migrate with a lot more ease. <br> <br> This would be less than a mandate for SSL, but make migration a lot less painful... Your thoughts?<br> <br> Gerald Beuchelt<br> Sun Microsystems, Inc. <br> </div> _______________________________________________<br>general mailing list<br><a href="mailto:general@openid.net">general@openid.net</a><br>http://openid.net/mailman/listinfo/general<br></blockquote></div><br></div></body></html>