<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I think, that these are just baby steps to the better. You are
certainly right below...and clearer definition of it has to be
proposed....Feeling like making an additional proposal for discussion?<br>
<br>
I also would like to see a change and definition, where SSL / TLS is
not required, in order to make this things very clear!<br>
<br>
Hans Granqvist wrote:<br>
<blockquote cite="mid454271C3.9030605@verisign.com" type="cite">
<pre wrap="">-1, if it's not too late
There are too many unknowns in this proposed change. While the
current text is not good, adding this to the spec is likely to
cause harm, for example:
What forms of SSL (incl. cipher suites) are recommended? What
is "a trusted authority" -- trusted by whom and for what? What
does "secure manner" mean?
I'm also wondering how the proposed security profiles correlate
with this change. It seems proper to reference these profiles
here. Can you shed some light?
Please also note that SSL has been more or less superseded by
TLS. TLS1 and SSL3 are quite similar, but not entirely, so
equating SSL with TLS should be spelled out. (Unless you imply
TLS is verboten, which I don't think is what you're doing :)
Hans
_______________________________________________
security mailing list
<a class="moz-txt-link-abbreviated" href="mailto:security@openid.net">security@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/security">http://openid.net/mailman/listinfo/security</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>