<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 03/21/2009 01:27 AM, Martin Atkins:<br>
<blockquote cite="mid:49C42657.3010108@degeneration.co.uk" type="cite"><br>
The original OpenID was designed to operate without SSL at all, with
parties establishing associations on the fly with no verification, and
it remains that way today on LiveJournal.com. Some folks wanted the
benefits that SSL brings, and that's fine... no-one's forcing you to
use SSL right now. I fought SSL being a requirement for OpenID 2.0 and
I will continue to fight it as I believe it should be up to each party
to decide whether it needs the benefits SSL provides.
<br>
<br>
<br>
</blockquote>
<br>
Yes, and with it you made the spec 2.0 less useful IMO. It's the
opinion of a few which dominated and effectively blocked an obvious
improvement to the spec, specially when compared to the amount of data
to protect. Do we care about the few self-served OPs which refuse to
even take the word "SSL" into their mouth or about the millions of
users data to be protected by the many?<br>
<br>
Clearly the major OPs decided already that they need the security and
protection SSL offers. Why should we send SREG and other data around in
plain text? For which benefit exactly? Why does OpenID has to align
with a handful of anti-PKI proponents serving a handful of users,
instead of creating a strong specification useful for the vast majority
serving millions of user authentications and data?<br>
<br>
I'm all for open, freedom and transparency, but it should stop when
those benefits present a unneeded risk!<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>