<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Pete Rowley wrote:
<blockquote cite="mid45416282.7090807@redhat.com" type="cite">There is
no fundamental difference between OpenID and direct account creation on
the site. You know your users by some unique identifier, you hope they
don't post their account and password to newsgroups but you can't be
sure they don't. </blockquote>
Right! But when thinking one step further on this specific subject, in
such a case, this would be the users responsibility (allowing for the
RP to react accordingly), whereas future login compromise (At the IDP
or RP) would be already the responsibility of the RP. But that's now
almost off-topic in this specific context.<br>
<blockquote cite="mid45416282.7090807@redhat.com" type="cite">Currently
in order to mitigate the risks of the billion account script spammers
sites ask for an email address in order to prove you have control over
an email account (now regardless of the fact that can easily be
scripted too) - nothing stops sites from continuing this policy. Once
profile exchange is added the transfer of the email address can be
automatic instead of an annoying additional step as it is now. Still
gotta click on the email link though. That is, unless you have some
other mechanism for gaining trust - like moderated comments until their
trust level reaches a threshold.
<br>
</blockquote>
OK, now on practical level, the user still has to perform every step
during registration at every forum/blog/etc in order to post, so the
time saving comes only at successive login's...Provided that the IDP
protects the login facility correctly (<u>which according to the specs
is currently completely optional</u>), than there is the same level of
trust/protection established...OK!<br>
<blockquote cite="mid45416282.7090807@redhat.com" type="cite">Your site
might also decide to trust certain IdPs. That is probably the first
thing that will occur - sites will trust a whitelist of IdPs to have
performed some form of adequate verification so that they do not need
to.
<br>
</blockquote>
This is implementation on the RP application level and has no specs, as
I understand it...right?<br>
<blockquote cite="mid45416282.7090807@redhat.com" type="cite">Anyway -
this is all obviously for the low end blog/forum stuff.
<br>
</blockquote>
Correct...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>