<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Gabe Wachob wrote:
<blockquote cite="mid001101c6f91f$8ad75cb0$7c00000a@AMSOFTWachob"
type="cite">
<pre wrap="">
This is where I think there's some tunnel vision. In many cases, it's the
*RELYING PARTY* that gets burned. Depends on the commercial context in which
the transaction is happening.. In some places, for example, a bank cannot
simply disclaim liability for an unauthorized access to online banking..
</pre>
</blockquote>
Great! I agree and would like once again to make one of the problems at
hand more clear by a few examples:<br>
<br>
First of all, as I understand it, <u>the OpenID community is promoting</u>
the use and very much <u>welcomes adoption of OpenID </u>(web sites
which offer login via OpenID URI). But I suspect, that today there are
be more OpenID IDP's than RP's, certainly not a situation of thousands
of RP's and a handful of IDP's. There might be a few reasons for this,
but let me explain, why <u>I</u> can't be a RP:<br>
<br>
Because there are no rules of behavior, standard and liability for
IDP's in the OpenID framework, but only the authentication protocol of
OpenID is defined, I can't rely on any IDP. There are currently no
requirements how an IDP performs authentication, secures the transport
of date between the user (client) and IDP server or how he stores any
data. IDP versus RP relation is another issue. <br>
<br>
But here comes OpenID, Verisign, SXIP and many others making convincing
statements why to use OpenID....why to adopt this technology! But
today, even for a super-low-risk forum or blog I can't use it right
now, because once the forum spamers understand that, they'll install
their own server and patch my forum with Viagra and Loans (I guess,
that this mail will land in most peoples spam filter ;-))<br>
<br>
So right now, I'm not proposing a solution to the problem, but ask you
on the list to provide me with a solution, which will be acceptable by
99% of forum and blog owners. This is the current low risk target of
RP's as mentioned various times on this list. Once we have a solution
for this, we can try to higher the stakes a little...If there is no
solution for the problem, than perhaps everybody should <u>stop
talking about adoption of OpenID</u> until it's solved!<br>
<br>
<br>
<blockquote cite="mid001101c6f91f$8ad75cb0$7c00000a@AMSOFTWachob"
type="cite">
<pre wrap="">
The mechanisms provided by OpenID today make the assumption that the end
user is the one who has all the risk and therefore gives the end user the
control over which IDP (and of course, which RP) to use.
</pre>
</blockquote>
Currently I see the risks for the RP the highest, because the user
might easily claim, that the RP offered (and even convinced) to make
use of OpenID URI...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>