<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Ashish,<br>
<br>
I updated the OpenID wiki with links to the openidreview Google docs
site. <br>
<br>
>From a specs perspective, do you have an opinion as to which issues
should be addressed in the next 6 months?<br>
<br>
Obviously some issues probably can never be resolved via an OpenID
spec, for instance CSRF/XSS on either the OP or RP is a problem that is
much broader than just OpenID.<br>
<br>
I think Session Swapping issue should probably be resolved in the spec,
as it's very similar to Login CSRF for sites that authenticate users
with a username/password. <br>
<br>
I believe that the Replay Attacks scenario could probably be resolved
by the Artifact Binding working group.<br>
<br>
The Diffie-Hellman issue is already in scope for OpenID 2.1. (I'm in
favor for removing DH)<br>
<a class="moz-txt-link-freetext" href="http://wiki.openid.net/OpenID_Authentication_2_1">http://wiki.openid.net/OpenID_Authentication_2_1</a><br>
<br>
Thoughts?<br>
Allen<br>
<br>
<br>
<br>
<br>
Ashish Jain wrote:
<blockquote
cite="mid:5b31c29d0911141914m7bedef88p77c74bec5ddd2baf@mail.gmail.com"
type="cite">Allen,<br>
Here is a link to some more description around the issues: <a
moz-do-not-send="true"
href="https://sites.google.com/site/openidreview/issues">https://sites.google.com/site/openidreview/issues</a><br>
<br>
Here is a link to the resources/papers that we mentioned: <a
moz-do-not-send="true"
href="https://sites.google.com/site/openidreview/resources">https://sites.google.com/site/openidreview/resources</a><br>
<br>
I haven't been able to find notes from Breno's IIW session. Here is a
link to the whiteboard picture: <a moz-do-not-send="true"
href="http://www.flickr.com/photos/_nat/4075945912/">http://www.flickr.com/photos/_nat/4075945912/</a><br>
<br>
Thanks,<br>
-Ashish<br>
<br>
<br>
<br>
<div class="gmail_quote">On Fri, Nov 13, 2009 at 7:22 PM, Allen Tom <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:atom@yahoo-inc.com">atom@yahoo-inc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi
All,<br>
<br>
There were several security discussions last week at the OpenID Summit
and IIW, and it's about time that we follow up on them:<br>
<br>
For those of you who weren't able to attend last week, some of the
presos are here:<br>
<a moz-do-not-send="true"
href="http://wiki.openid.net/OpenIDSummit2009" target="_blank">http://wiki.openid.net/OpenIDSummit2009</a><br>
<br>
And I started a wiki here:<br>
<a moz-do-not-send="true"
href="http://wiki.openid.net/SecurityIssues" target="_blank">http://wiki.openid.net/SecurityIssues</a><br>
<br>
A new issue (at least to me) is the Session Swapping issue reported by
Ashish Jain, Andrew Nash, and Jeff Hodges of PayPal. A potential
solution is to have the RP do something similar to a checkid_immediate
request after receiving an assertion. This would allow the RP and OP to
confirm that the assertion was actually issued by the OP to the user
that's trying to authenticate at the RP, at the cost of another round
trip.<br>
<br>
Another issue that's always discussed is Phishing. While I don't think
we will completely solve the phishing problem in the near future, there
are things that we can do now to help protect users from phishing. The
client side OpenID selectors that were demoed last week can potentially
improve both usability and security for users who have them installed.<br>
<br>
Some applications have issues with OpenID assertions being transmitted
unencrypted via the user's browser. I believe that the Artifact Binding
WG will try to address this issue.<br>
<br>
Anything else? It looks like there's consensus that Single Sign Out
should be deferred for the time being.<br>
<br>
Allen<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
general mailing list<br>
<a moz-do-not-send="true" href="mailto:general@lists.openid.net"
target="_blank">general@lists.openid.net</a><br>
<a moz-do-not-send="true"
href="http://lists.openid.net/mailman/listinfo/openid-general"
target="_blank">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
</blockquote>
</div>
<br>
</blockquote>
<br>
</body>
</html>