<div class="gmail_quote">On Tue, Jan 27, 2009 at 8:11 PM, Peter Williams <span dir="ltr"><<a href="mailto:pwilliams@rapattoni.com">pwilliams@rapattoni.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><span style="font-size: 11pt; color: rgb(31, 73, 125);">So now you getting somewhere with multiauth. It was amorphous
before.</span></p>
<p><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p>
<p><span style="font-size: 11pt; color: rgb(31, 73, 125);">To mitigate the risk of OP misconduct in the form of inappropriate
impersonation of a subscriber, relying parties may require multiple
confirmations of user involvement from different authorities. <br></span></p></div></div></blockquote></div><br>Yes, though MultiAuth really only discusses how an end-user could require MultiAuth. If an RP wants to require MultiAuth, then it simply can -- I don't think there's needs to be any new behavior defined by a spec in that case.<br>
<br><br>