<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [OpenID] Backwards
Compatibility</title></head><body>
<div>>>I'd like to remove the requirement for SSL enabled OPs to
support DH. Are there any OPs that don't support HTTPS?</div>
<div>></div>
<div>>Of course. But perhaps the useful question could
phrased "are there any OPs that don't support HTTPS that people
would cry about not working any more?"</div>
<div><br></div>
<div>Definitely! Individuals running their own OP's who don't care
about security (because they only use it for leaving comments, and
other low-value purposes), but *do* care about privacy (not giving
*any* third party information about their OpenID activity on the web),
and can't afford to use website hosts that provide SSL.</div>
<div><br></div>
<div>(Note that "can't afford to use" doesn't just mean
"free as in beer", here; if the providers require
registration information that the user, for privacy reasons, will not
divulge, they cannot afford to use that provider's services. It's
simple logic, albeit of the sort that seems to flee users' minds
whenever faced with an SLA for software.)</div>
<div><br></div>
<div>Perhaps the use of SSL could be added into the minimum assurance
levels area of the spec, so that users who insist on using OpenID but
refuse to use a SSL-enabled OP will simply be unable to achieve any
level of assurance beyond the very lowest? Sufficient for comment spam
and the like, so OpenID still has *some* use to end-users.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>