<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 03/23/2009 02:53 AM, Allen Tom:
<blockquote cite="mid:49C6DDA3.8040201@yahoo-inc.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
Eddy Nigg (StartCom Ltd.) wrote:
<blockquote cite="mid:49C6DAD9.6000608@startcom.org" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<br>
Your assumptions that users will notice the difference between a window
with and without address bar are basically wrong. A small research
would tell you that most users will enter their details anyway.<br>
<br>
</blockquote>
Does the popup make things worse for users who don't pay attention to
the address bar or to any visual indicators?<br>
</blockquote>
<br>
Most likely it makes it even more difficult and a bit more likely that
they won't pay attention. Some study and research would be in place
perhaps (proposal for the WG?)<br>
<br>
<blockquote cite="mid:49C6DDA3.8040201@yahoo-inc.com" type="cite">
<blockquote cite="mid:49C6DAD9.6000608@startcom.org" type="cite">Which
leads
us again to the issue of user/pass pairs and their
usefulness </blockquote>
OpenID does not specify how the user authenticates with their OP, so
OPs are free to deploy authentication methods other than passwords.<br>
</blockquote>
<br>
Sure. We know that (for the better and worse) :-)<br>
<br>
<blockquote cite="mid:49C6DDA3.8040201@yahoo-inc.com" type="cite">As
far as I can tell, all phishing sites currently use a full browser
window, so I'm not sure how the full browser window is more resistant
to phishing compared to a popup.<br>
<br>
</blockquote>
<br>
Neither am I...it's a wild guess I'm having. I suggest to find out
about it in the WG through a proper study. It even could benefit OpenID
at large if the research would be a bit extended...<br>
<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>