<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ben Laurie wrote:
<blockquote
cite="mid1b587cab0810220254t67c94d36s6166ea37004926f0@mail.gmail.com"
type="cite">
<pre wrap="">On Wed, Oct 22, 2008 at 3:52 AM, Allen Tom <a class="moz-txt-link-rfc2396E" href="mailto:atom@yahoo-inc.com"><atom@yahoo-inc.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">OpenID does not specify how the user authenticates with their OP, so OPs
which support hooks for client side authentication seem to address your
concerns.
</pre>
</blockquote>
<pre wrap=""><!---->
Only if all of them do, and all client-side auth is consistent, and
all clients support client-side auth, otherwise, well, it isn't
consistent, and we've agreed that is bad.
If my concerns were _actually_ addressed, there would be no phishing.
</pre>
</blockquote>
I believe the point is that there's nothing in OpenID to stop the UX
consistency campaign. Campaign away! <br>
<br>
But... your requirements above seem to imply that<br>
<br>
(1) We are using the same authentication UX for nuclear secrets as we
do for logging in to a gossip site;<br>
(2) We have to get every browser / user agent, and every IdP, to buy
into the same UX (at close to the same time) and train users on how to
use the new UX.<br>
<br>
So, while I cheer the campaign's ultimate goals, I think there's an
underwear gnomes problem in the plan as stated.<br>
<br>
John<br>
<br>
</body>
</html>