<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 12/12/2008 09:24 AM, Luke Shepard:<br>
<blockquote cite="mid:C56751A1.222A1%25lshepard@facebook.com"
type="cite"><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 12pt;"><br>
<b>Things that don’t matter: </b>OpenID as a brand. As Scott put,
who cares about the brand of SMTP? Or HTTP?. Also, some stuff is pretty
minor. Like end-to-end support of HTTPS identifiers. If it gets in the
way of usability and adoption, then it sucks. The real question is, is
an HTTP identifier more secure and usable than using an email and
password. If so, then move on.<br>
<br>
</span></font></blockquote>
<br>
Facebook might not care about security and if their user accounts get
phished and broken by whatever means, but the heavyweights in the
computer industry certainly do. Other corporations as well. Just heard
yesterday from a representative of one of the biggest firms out there
(without disclosing names) what their real problem is (with OpenID) and
what needs to change in their point of view in order to higher the
adoption rate of relying parties (including themselves). You bet that
security is (still) one of the main concerns. Please also note that
your provider (Facebook) is only a relying party to itself - if you
really believe in what you said above than open up and extend the trust
to all possible OpenID providers.<br>
<br>
Facebook Connect? I guess it will be as relevant to WebSSO as Alta
Vista is for search today - but OpenID is intended to penetrate and
influence a particular pattern and behavior of the main stream user and
his/her Internet experience. Those were educated to enter user names
and passwords for more than a decade, it will take some time to educate
them to something different. OpenID is more than a protocol or
specification - it's a spec, product and educational effort where
security can't be optional but is a way of life (the same way you've
got a lock at your house's door). Besides that, SSL/TLS isn't such a
big deal these days, it's the norm for any authentication form I think.<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>