<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
what do proxies (gateways) do?<BR> <BR>well, in openid, we have always had the naming proxy. Setup the meta in a blog site, and its naming keeps an OP from controlling the name used at an RP. In the XRI server case of the same thing (with XRI names or HXRI names (i.e. http URIs) , the security benefits were even stronger. We perhaps all remember the pinnacle of this being reached when not only did the XRI/HXRI server dis-intermediate the OP in the name space world, but also it signed the XRDS chain too. Arguably, the Google signed XRD and host-metas do the same same thing, in a more cloud-centric manner; and DNS provides the CNAMES.<BR> <BR>But, the microsoft model goes beyond these things well know to the openid community since the outset (and then the harmonization with XRI): becuase it actually translates the tokens - from one blob format to another, on the fly. Issuing 10,000 signatures a sec, even with RSA, is trivial these days. The main point is that when interfacing to legacy RP apps, the gateway has more local knowledge of the RP needs for named claims and the formats of data typed values - allowing it to translate field names between what Google name things and format things, and what/how the legacy RP names.format things. The gateway is a classical bridge (according to my professor of internet studies, who built internet gateways for a research living from 1958 onwards...), translating between one mail format and another..., one address scheme and another, one security wrapper (PGP) and another (S/MIME). So, in the token world, goes the same story.<BR> <BR> <BR> <BR> <BR><br> <BR><div>> Date: Thu, 7 Jul 2011 23:00:19 -0700<br>> To: home_pw@msn.com<br>> From: sysadmin@shadowsinthegarden.com<br>> Subject: [OpenID] Re: last mile politics<br>> CC: openid-general@lists.openid.net<br>> <br>> >Much as in the PKI era, these will not be built in the interests of <br>> >individuals in society. Lose your access as a subscriber at an IDP <br>> >or lose a rights to a name during a pending dispute, you WILL lose <br>> >access at your SP sites -since they are tightly bound to the OP.<br>> ><br>> >This is not a viable national infrastructure. Its certainly not a <br>> >viable trans-national infrastructure.<br>> <br>> Recent years have seen projects for UCI independence (Tor in every <br>> router, wallplug servers every person can carry with them, p2p wifi <br>> over low-orbit hot air balloons), words like "convergence" coming to <br>> mind. The technologies were all there; OpenID seemed like one of <br>> them, but active use slowly left more of an impression that it was <br>> developing in a different direction.<br>> <br>> The practical limits are not just Name (unique entry in namespace <br>> governed by authoritative gatekeeper) versus Number (signed <br>> crytographic key/card/cert/etc), where those sites unable (or <br>> unwilling) to make the switch toward a more secure means of <br>> authentication must deal with 3rd parties that promise to have done <br>> those security checks, and will translate it to a unique <br>> corresponding entry in namespace; SP's will also have access to their <br>> immediate networks only. (Yes, some sites can alternately be reached <br>> through Tor/I2P addresses - but if you gave them a street address, <br>> they would choke in puzzlement, whereas a different company on the <br>> main internet might offer to provide a proxy service for reaching a <br>> person at that address through snailmail, whatever.) When there *is <br>> no* direct channel of communication between SP and IDP, they *must* <br>> relay information to each other through trusted (by both) proxies, <br>> possibly a chain of them. (XRI was supposed to help with this.)<br>> <br>> Proxies seem to challenge the OpenID security model at first, but on <br>> further reflection are probably integral to the future use-cases. I <br>> still have doubts about using proxies within the same network (where <br>> direct communication *can* take place), but it's likely I just don't <br>> understand what the service is trying to offer.<br>> <br>> -Shade<br></div> </div></body>
</html>