<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [OpenID] Logout Use Case</title></head><body>
<div>>The detail that RP1 required positive assertions from OP1<i>
and</i> OP2 to log the user in seems inconsequential.</div>
<div><br></div>
<div>Or it could be a varying-levels-of-assurance login, with the user
able to provide higher levels as needed to take sensitive actions
(perhaps through an OP that only authenticates for 5 minutes at a
time, and uses one-time passwords).</div>
<div><br></div>
<div>>As soon as RP1 gets the "log out" assertion from
the OP, it only has OP2 with a standing positive assertion left, and
therefore logs the user out.</div>
<div><br></div>
<div>Or it lowers the user's level of access, and the user merely
*thinks* their terminal has been logged out. This worries me. If the
OP signals (somehow) that this is (intended as) a universal logout,
how does a RP signal back that the user ought to visit their site for
more actions, without revealing the likelihood of other active OP's?
(It may be unavoidable. RP's supporting MultiAuth should probably
alert the user to the difficulty of balancing privacy with universal
logout.)</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>