<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Martin, your suggestions are interesting! However isn't there a danger
of a split of networks and fragmentation? Perhaps it might be useful to
include a "trust anchor" in the OpenID specs, which would define, how
trust networks should be approached? This could be some identifier or
list of known "trust networks", which allows an RP to select and act
accordingly to the networks specific specifications...This would
guaranty, that all RP's still can talk to all (requested) IDP's,
without failing to to talk to X or Y, because it doesn't know, which
specs it follows...Something like "trust discovery"?<br>
<br>
Since third parties must be involved in this (i.e. "OpenID Registry",
"Verisign Trustnetwork" ;-), "xdi.org"), which according to their
policy control adherence to it, the RP must know about them in first
place....Otherwise very soon, none of the various networks will be
compatible...or requires from the RP to implement many different specs
in order to stay compatible with them all...<br>
<br>
Suggestions?<br>
<br>
Martin Atkins wrote:
<blockquote cite="mid45429EC0.7020005@degeneration.co.uk" type="cite">
<pre wrap="">Eddy Nigg (StartCom Ltd.) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">A central repository of a list of registered IDP's. The RP can define if
he wants to check with that list or not.
If yes, the RP checks with the list and receives a green light, else it
fails.
</pre>
</blockquote>
<pre wrap=""><!---->
As has been noted a few times, OpenID is focused on solving a very
particular problem, and that problem does not include trust. Mostly
we've been talking about trust of Identifier URLs so far, but this
applies to IdPs as well.
RPs are, per the spec, free to refuse to associate with a given IdP
based on whatever criteria they choose. The upshot of this is that a
separate effort, independent of the OpenID auth spec, can provide some
kind of trust system — possibly based on the system you describe — for
IdPs. RPs can choose to use your system, or they might use someone
else's system. This is consistent with the decentralized spirit of OpenID.
Since this seems to be your area of expertise and an area of interest to
you, I encourage you to write up a more formal proposal — on the wiki,
for example — for some kind of protocol for checking IdP trust which can
be employed by RPs as one of their mechanisms for discriminating against
IdPs. However, the whole subject of inter-party trust is deliberately
not considered in OpenID; we're not trying to save the world. :)
_______________________________________________
security mailing list
<a class="moz-txt-link-abbreviated" href="mailto:security@openid.net">security@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/security">http://openid.net/mailman/listinfo/security</a>
</pre>
</blockquote>
<br>
<div class="moz-signature"><br>
</div>
</body>
</html>