<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
So I don't disagree that OpenID is equivalent to "resetting the
password via email" because in essence those sites are trusting the
security of the email provider for their access. But I don't see how
this applies to a UI where users can accidentally give out their email
password? If I have a personal policy that uses a strong password for
my email account and less strong passwords for other sites, then I
would want to protect that strong password for my email account and
only give it to my email provider. I still see this as a significant
security issue because many users don't understand what is happening.<br>
<br>
Of course, from an RP perspective, getting the greatest number of
people through the login process is the highest priority. It would just
be nice to find a solution that doesn't allow the user to be
"in-secure" by accident.<br>
<br>
Thanks,<br>
George<br>
<br>
Allen Tom wrote:
<blockquote cite="mid:48D9B9D6.3070805@yahoo-inc.com" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<br>
<br>
George Fletcher wrote:<br>
<blockquote cite="mid:48D90523.2050800@aol.com" type="cite">
<pre wrap=""><!---->I do have a security concern with this approach in that most likely the
AOL user will enter their AOL password because of the past experience.
</pre>
</blockquote>
I also believe that presenting a username/password combo is a bad idea,
from a security perspective. Based on our own usability studies, Yahoo
users will type in their YahooID/Password.<br>
<br>
That being said, most newer websites allow users to sign in using their
email address, and will reset the user's password via email. As Simon
Willison mentions in his OpenID talks, allowing OpenID for login is
equivalent to allowing a password to be reset via email, just with a
much better user experience.<br>
<br>
Allen<br>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
</body>
</html>