<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
OK, so what do we have in the draft:<br>
<br>
<h3><i>Abstract</i></h3>
<p><i> OpenID Authentication provides a way to prove that an End User
owns an Identifier. It does this without the Relying Party needing
access to password, email address, or other sensitive information.<br>
</i></p>
<p><b>This means, that instead of providing a user name, email and
password, the RP receives an identifier and prove of possession from
the end user (actually not from the end user, but from the IDP). Now
comes the question, what is the basis for being able to provide such an
identifier and what is going to make the RP to feel warm and cozy about
giving this crucial part of <u>AUTHENTICATION</u> to an external
source? Why should an identifier be better than an user
name/password/email pair?<br>
</b></p>
<p><i> OpenID is decentralized. <br>
</i></p>
<p>Yes, the network is decentralized...</p>
<p><i>No central authority must approve or register Relying Parties or
Identity Providers. <br>
</i></p>
<p>I have a problem with this one, since I believe, that there might be
in the end some kind of authority for compliance reasons perhaps,
specially on the IDP's...But this is perhaps for later after we agree,
that there must be a certain compliance by the IDP's.<br>
</p>
<p><i>An End User can freely choose which Identity Provider to use. <br>
</i></p>
<p>Right!</p>
<p><i>They can preserve their Identifier if they switch Identity
Providers.</i></p>
<p>Not sure about that one....The whole URI or only the first part, aka
user name of an URI? What if it's occupied already at a different IDP?<br>
</p>
<p><i> While nothing in the protocol requires JavaScript or modern
browsers, the authentication scheme plays nicely with "AJAX"-style
setups, so an End User can prove their Identity to a Relying Party
without having to leave the page they are on.<br>
</i></p>
<p>Blah, blah...is this relevant at all? Is THIS important?<i><br>
</i></p>
<p><i> OpenID Authentication uses only standard HTTP requests and
responses, so does not require any special capabilities of the
User-Agent or other software.<br>
</i></p>
<p>Well, now that's already not true! Accepted are http, https and
xri....Needs to be corrected...<br>
</p>
<p><i> The exchange of profile information, and other features not
covered in this specification, is addressed through additional Service
Types built on top of OpenID.<br>
</i></p>
<p>OK...I can live with that....So hopefully, this will be part of the
OpenID spec's too...<br>
</p>
Now I took only the very first part of the draft spec's in order to
show, that there are things which might be corrected, defined and
included better...Specially the very first sentence requires a lot of
work....Suggestions?<br>
<br>
Recordon, David wrote:
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F31529EA@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta content="MSHTML 6.00.2900.2873" name="GENERATOR">
<div dir="ltr" align="left"><span class="015021500-26102006"><font
color="#0000ff" face="Arial" size="2">So after typing that, please
realize that is a one sentence definition of what it currently is.</font></span></div>
<div dir="ltr" align="left"><span class="015021500-26102006"></span> </div>
<div dir="ltr" align="left"><span class="015021500-26102006"><font
color="#0000ff" face="Arial" size="2">--David</font></span></div>
<br>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>