<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
isnt the domain of 'resistant to phishing' or not the domain of PAPE?<br>
<br>
Andrew Arnott wrote:
<blockquote
cite="mid:216e54900903200724s20a103c3k794664aa3f356930@mail.gmail.com"
type="cite">
<div>You know what would be neat is if there was an OpenID extension
by which an RP can discover whether an OP deemed it safe to have its
login page be placed in an RP's iframe. OPs can place their login
pages in iframes totally safely, I'd say, if they took InfoCard as
their login credential.</div>
<div><br clear="all">
--<br>
Andrew Arnott<br>
"I [may] not agree with what you have to say, but I'll defend to the
death your right to say it." - Voltaire<br>
<br>
<br>
<div class="gmail_quote">On Thu, Mar 19, 2009 at 7:07 PM, Allen Tom <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:atom@yahoo-inc.com">atom@yahoo-inc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi
Andrew,<br>
<br>
I am in total agreement with you that phishing is a huge problem, and
the Yahoo Membership team (the same folks working on OpenID) devotes a
considerable amount of resources to fight phishing, and well as trying
to help users who have been phished.<br>
<br>
We also put in a lot of effort to educate users about phishing, and we
strongly encourage our users to setup a personalized anti-phishing
Sign-in Seal, as well as to always check the address bar of the browser
before entering their Yahoo credentials.<br>
<br>
<a moz-do-not-send="true"
href="http://security.yahoo.com/article.html?aid=2006102503"
target="_blank">http://security.yahoo.com/article.html?aid=2006102503</a><br>
<a moz-do-not-send="true" href="https://protect.login.yahoo.com/"
target="_blank">https://protect.login.yahoo.com/</a><br>
<a moz-do-not-send="true" href="http://openid.yahoo.com/"
target="_blank">http://openid.yahoo.com/</a> (Click on the OpenID Tour
link to learn about phishing and OpenID)<br>
<br>
We are totally against the concept of allowing an RP to open a frame
for the user to enter their OP's password. As you pointed out, the user
would have no idea where the password is going, and this would be
extremely insecure. Earlier versions of Facebook Connect used to
demonstrate this behavior, and I'm very glad to see that Facebook has
since moved the password validation into a standalone popup window,
with the browser's addressbar clearly displayed.<br>
<br>
One of Yahoo's primary security requirements with Federated SSO
(OpenID, OAuth, BBAuth, SAML) is that the user is able to recognize the
Yahoo Login screen. We do this by educating users to always check the
address bar and to create a customized Sign-in Seal. The UI Working
Group believes that a popup authentication screen, in a standalone
browser window (not framed) and with the address bar clearly displayed,
providers users with the same ability to detect phishing compared to
the existing full browser redirect user experience that is used by
OpenID today.<br>
<br>
>From a user experience perspective, eliminating the browser
redirect maintains the context of the RP's site, which is the biggest
complaint that we've received with BBAuth, OAuth, and OpenID.
Facebook, Yahoo, many others have UX research showing that the
redirect is a very jarring experience, and the success rate can be
dramatically improved by moving to a popup flow.<br>
<br>
As far as I can tell, an independent popup window, with the address bar
displayed, has the same characteristics with regards to phishing, as
the full browser redirect. The popup window does not prevent OPs from
deploying anti-phishing technologies, and I believe that the popup will
drive more widespread usage of OpenID, which will also increase demand
for anti-phishing solutions.<br>
<br>
thanks<br>
Allen<br>
<br>
<br>
Nash, Andrew wrote:<br>
<br>
<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
One of the ways that we have been able to reduce the incidence of<br>
successful account takeovers has been to drill into consumers that they<br>
should NEVER sign into an account on a domain that is not directly<br>
associated with the account provider. This is not perfect, but then none<br>
of the anti-phishing techniques are - it is why we have to spend so much<br>
money and utilize so many different strategies.<br>
<br>
As it reads, UI working group will be socializing the concept among<br>
users that it is perfectly fine to enter your authentication information<br>
at any site that pops up a frame asking for it. From an Internet trust<br>
perspective this is a REALLY BAD IDEA!<br>
<br>
OpenID is already criticized for its exposure to phishing and spoofing<br>
attacks. If this approach is taken in the way it seems to be described,<br>
we will pretty much ensure that no one that has medium to high value<br>
transactions or services will be interested in implementing OpenID.<br>
<br>
--Andrew<br>
<br>
_______________________________________________<br>
general mailing list<br>
<a moz-do-not-send="true" href="mailto:general@openid.net"
target="_blank">general@openid.net</a><br>
<a moz-do-not-send="true"
href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
<br>
</blockquote>
<br>
_______________________________________________<br>
general mailing list<br>
<a moz-do-not-send="true" href="mailto:general@openid.net"
target="_blank">general@openid.net</a><br>
<a moz-do-not-send="true"
href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
</blockquote>
</div>
<br>
</div>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
<pre wrap="">
<hr size="4" width="90%">
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.557 / Virus Database: 270.11.21/2014 - Release Date: 20/03/2009 6:59 AM
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<font size="-1">Paul Madsen<br>
e:paulmadsen @ ntt-at.com<br>
p:613-482-0432<br>
m:613-282-8647<br>
web:connectid.blogspot.com<br>
</font><a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1"><img
src="cid:part1.06070601.07020608@rogers.com" alt="ConnectID"
style="border: 0pt none ;"></a></div>
</body>
</html>