<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Rebecca,<div><br></div><div>There are definitely a few providers that have attempted to tie a real-world identity to an OpenID, particularly in Japan, but they are very much in the minority. Nevertheless, a market could build around this if there were a strong demand for it. They don't exist today, but given proper incentive with services like yours, they certainly could.</div><div><br></div><div>The more fundamental problem is that the specs as they stand just don't really support strong authentication. No matter how good nor bad the identification verification that's done at the OP, the inherent lack of any defined trust fabric makes it really hard to get that trusted identity to the RP with any degree of assurance.</div><div><br></div><div>There are a couple proposals in the works right now to address this shortcoming.</div><div><br></div><div>One of them is called PAPE, which offers the ability to self-assert how good a job you do with identity verification. It primarily focuses on the quality of authentication, and not the quality of the identity checking, though it could be used for both and indeed references some NIST specifications that encompass both. You can have very strong authentication to a weakly checked identity, or vice versa, but the quality in the end is generally capped by the lesser of the two. This is in public review right now.</div><div><br></div><div>The other one is provisionally called TX, which attempts to associate a contract with a particular transaction. I personally think it's a key area with a lot of work to be done. I don't agree with the fundamental approach in the current proposal, because the part that's signed is not strongly bound to any attributes or identities that are passed. It's a bit organic. Others will probably have different views. Something in this space is a key future addition, though.</div><div><br></div><div>A final place work needs to be done is the establishment of broad trust structures that operate multilaterally, allowing these above trust handshakes to scale. We do this now with a structure called federations (ours being InCommon, for the higher education and research space in the US), but it's not clear whether these will ultimately scale. Reputation services are another idea here that remain in the sketch stage.</div><div><br></div><div>If you're operating with a small set of strongly trusted OP's/identity sources, you can handle all this trust out of band. If you want a solution that works in band using the OpenID protocols themselves, you've probably got a while yet to wait.</div><div><br></div><div>Take care,</div><div>Nate.</div><div><br><div><div>On 4 Nov 2008, at 05:10, Rebecca Cannon wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 10px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; ">I'm researching a new online service that I will be building. I want to use Open ID, however we're going to require real-world identification verification, as the service will have legally binding information in it.<br><br>Just wondering whether open id is being used with real-world identification verification, and what the list's thoughts are on this.<span class="Apple-converted-space"> </span><br></span></blockquote></div><br></div></body></html>