Right, Eddy. Eric, an HTTPS claimed id and an HTTP claimed id are required to be regarded by an RP as completely distinct identities. And by using HTTPS you are <i>only protecting the discovery phase</i> of authentication. You protect the first leg of authentication by making discovery return an HTTPS OP endpoint URL, and the OP is obliged to protect the rest of authentication by only redirecting the user agent to HTTPS urls until it finally redirects back to the RP.<br>
<br clear="all">--<br>Andrew Arnott<br>"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - Voltaire<br>
<br><br><div class="gmail_quote">On Thu, Jan 1, 2009 at 4:00 PM, Eddy Nigg (StartCom Ltd.) <span dir="ltr"><<a href="mailto:eddy_nigg@startcom.org">eddy_nigg@startcom.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div text="#000000" bgcolor="#ffffff">
<br>
On 01/02/2009 12:49 AM, Eric Norman:
<div class="Ih2E3d"><blockquote type="cite">
<pre>On Jan 1, 2009, at 4:28 PM, Peter Williams wrote:
</pre>
<blockquote type="cite">
<pre>The openid 2 spec says in section 15 (a non-normative must, note):
"In order to get protection from SSL, SSL must be used for all parts
of the interaction, including interaction with the end user through
the User-Agent."
</pre>
</blockquote>
<pre>When I include "https:" in my OpenID, I'm saying that I
want protection by SSL, right?
</pre>
</blockquote>
<br></div>
Your OpenID is <a>https://</a> then, it's not ncesseraly the same as http and
the other way around too. It has been many times already mentioned. <br><div class="Ih2E3d">
<br>
<blockquote type="cite">
<pre>So if something elsewhere decides not to use SSL for
whatever reason, that would be incorrect behavior, right?
</pre>
</blockquote>
<br></div>
Correct. However an OP may return the claimed OpenID as https (there
are for example some OPs which don't do plain http, only https via
redirect.<div class="Ih2E3d"><br>
<br>
<blockquote type="cite">
<pre>And let's not forget that the error message I quoted is
clearly inappropriate.
</pre>
</blockquote>
<br>
<br>
</div><div>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org" target="_blank">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a>startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org" target="_blank">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</div>
<br>_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@openid.net">general@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
<br></blockquote></div><br>