It is not a question of expanding scope. From a security standpoint, it makes no sense to assess only one aspect of the flow. It could be argued that the other aspect of the flow (performing discovery of the OpenID identifier to resolve the OP) is already performed by the RP so it can assess the security of that secondary flow directly. One then hopes that RPs will be sophisticated enough to understand that if they do not assess that flow themselves (and know how to do it) then they get essentially no benefit from using PAPE.<br>
<br><div class="gmail_quote">On Fri, Jul 10, 2009 at 11:50 AM, Johnny Bufu <span dir="ltr"><<a href="mailto:johnny.bufu@gmail.com">johnny.bufu@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div id=":32p" class="ii gt">If PAPE or other extensions expand their scope and include the claimed<br>
identifiers or other entities into what they assert - it's a totally<br>
different deal.<br>
<div class="im"></div></div></blockquote></div><br><br clear="all"><br>-- <br>--Breno<br><br>+1 (650) 214-1007 desk<br>+1 (408) 212-0135 (Grand Central)<br>MTV-41-3 : 383-A <br>PST (GMT-8) / PDT(GMT-7)<br>