<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
<br>
On 01/02/2009 12:49 AM, Eric Norman:
<blockquote cite="mid:b0db1a890003c27728ff02c32c50fccc@doit.wisc.edu"
type="cite">
<pre wrap="">On Jan 1, 2009, at 4:28 PM, Peter Williams wrote:
</pre>
<blockquote type="cite">
<pre wrap="">The openid 2 spec says in section 15 (a non-normative must, note):
"In order to get protection from SSL, SSL must be used for all parts
of the interaction, including interaction with the end user through
the User-Agent."
</pre>
</blockquote>
<pre wrap=""><!---->
When I include "https:" in my OpenID, I'm saying that I
want protection by SSL, right?
</pre>
</blockquote>
<br>
Your OpenID is <a class="moz-txt-link-freetext" href="https://">https://</a> then, it's not ncesseraly the same as http and
the other way around too. It has been many times already mentioned. <br>
<br>
<blockquote cite="mid:b0db1a890003c27728ff02c32c50fccc@doit.wisc.edu"
type="cite">
<pre wrap="">
So if something elsewhere decides not to use SSL for
whatever reason, that would be incorrect behavior, right?
</pre>
</blockquote>
<br>
Correct. However an OP may return the claimed OpenID as https (there
are for example some OPs which don't do plain http, only https via
redirect.<br>
<br>
<blockquote cite="mid:b0db1a890003c27728ff02c32c50fccc@doit.wisc.edu"
type="cite">
<pre wrap="">
And let's not forget that the error message I quoted is
clearly inappropriate.
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>