<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Peter,</div><div><br></div><div>I fully agree today, but I want the statement "OpenID is different to Shibboleth" to be fundamentally wrong in the future. I want the statement, "your deployment can use trusted, managed identity sources, or take all comers, with the software of your choice" to be true instead. Deployers shouldn't be asked to select between protocols and non-interoperable software packages. That's our collective failure as an identity community. They should just pick the implementation, trust, UX, and privacy rules that support their needs the best, and it should work with the implementations others have.</div><div><br></div><div>Shibboleth has been battling non-interoperability with SAML vendors very hard, and we all finally made some progress. Google's OAuth work and CardSpace are trying to bring everything together, and Shibboleth can support much of both already. Adding trust to OpenID is another good step.</div><div><br></div><div>Convergence ain't just an 11-letter word. It's our duty to our users and deployers.</div><div>Nate.</div><div><br></div><div><div>On 4 Nov 2008, at 12:36, Peter Williams wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">OpenID is different to Shibboleth. OpenID brings the likes of Yahoo and Google assertions to RPs (just like us). I don’t WANT to manage the 6 million consumers who come to our website, anymore than I want to manage their email boxes. Let ads (on other people’s sites) pay for all that!<o:p></o:p></span></p><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></p></span></blockquote></div><br></body></html>