<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#1F497D'>I’m not sure about this
being the “ultimate” solution: but the thread and its links were definitely
very valuable to me. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I learned a lot about the
doctrine of OAUTH (and “FireEagle”) that was just not apparent in
the technical spec. he spec focused on the free and fun world of SPs –data
sources supporting OpenID RPs. If these control ideas are part and parcel of
OAUTH culture, I think I’m starting to understand why Eran seemed to
distraught during the election process. There may well be a cultural disconnect,
over the issue of OP control. This disconnect contrasts with the obvious and apparently
easy opportunity to harmonize the bits and bytes of the two protocols<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>To make software, in the interests
of “security and safety of users” (always a dodgy introduction in a
control culture) developers used to be commonly subject a distributor’s certification
of their PC app’s code. In particular, one may remember that app designers
targeting the Apple platform had to ensure the app’s look was consistent
with the platform’s goals. (Originally, this used to include even being required
to submitting your business plan to Apple). <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>For OAUTH, this seems to translate:
“portals” acting as OPs will not certify third-party apps as
consumers of the assertion (i.e. will refuse to issue backchannel passwords or
will revoke an existing credential) if the app fails to continually demonstrate
that it adopts certain design patterns that promote the browser (vs. the PC or
PKI) as the trust system. If a third party site uses an embedded browser
control, for example, the app not be certified (as it compromises user identity
protection boundary). The argument is that any website design practice that doesn’t
advocate using the “browser as a trust platform” fails to counter
phishing attacks by fraudulent websites).<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Have I correctly captured the
social issue? I note the advocacy of certain folks who want the Foundation to
promote and certify “UX”, too.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
general-bounces@openid.net [mailto:general-bounces@openid.net] <b>On Behalf Of </b>Steven
Livingstone-Perez<br>
<b>Sent:</b> Thursday, January 08, 2009 5:04 AM<br>
<b>To:</b> general@openid.net<br>
<b>Subject:</b> [OpenID] The OpenID and OAuth Flow: Playing with UX<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>This is an excellent piece and discussion OpenID as part of
the article. Should be a kick off to design (at least on paper) the
“ultimate” solution I’d think.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><a href="http://ben-ward.co.uk/blog/oauth-flow/">http://ben-ward.co.uk/blog/oauth-flow/</a><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>steven<o:p></o:p></p>
<p class=MsoNormal>http://<a href="http://friendfeed.com/rooms/openidstream">friendfeed.com/rooms/openidstream</a><o:p></o:p></p>
<p class=MsoNormal>http://livz.org<o:p></o:p></p>
</div>
</div>
</body>
</html>