<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Martin Atkins wrote:<br>
<blockquote cite="mid4543709A.8080002@degeneration.co.uk" type="cite">
<pre wrap="">The spec that we are calling "OpenID Authentication" provides a protocol
for an RP to ask an IdP whether some user controls a given URI.
</pre>
</blockquote>
A noble goal!<br>
<blockquote cite="mid4543709A.8080002@degeneration.co.uk" type="cite">
<pre wrap="">It specifies the use of another protocol — Yadis — as a mechanism to
discover a list of IdPs that will answer for a given URI.
</pre>
</blockquote>
Which is where trust could be discovered as well...<br>
<blockquote cite="mid4543709A.8080002@degeneration.co.uk" type="cite">
<pre wrap="">Anything else is outside of the scope of OpenID Authentication.
</pre>
</blockquote>
Up to here everything seems to be fine. But pretending and suggesting
that OpenID can or should be used in real world (and is ready for real
world usage), even encouraging the use and integration of it by
bounties, knowingly fully well, that the technology isn't secured, is
untrusted and as such may cause damage, is really a flaw! If it would
be advised NOT to make use of OpenID, because for this, that or other
reasons, this would be completely acceptable...<br>
<blockquote cite="mid4543709A.8080002@degeneration.co.uk" type="cite">
<pre wrap="">
You will probably note that OpenID 2.0 has grown this scope a small
amount with the concept of directed identity, which provides a mechanism
for an RP to ask an IdP to respond with a URL that somehow represents a
user. [1]
Notice that I'm distinguishing between "OpenID Authentication", which is
the spec we're currently working on, and "OpenID" itself, which I hope
will will slowly grow into a suite of inter-operable technologies
related to decentralized identity.
There are a few other specs currently being considered which are related
to, but are not part of, OpenID Authentication:
* "Simple Registration", for automating the provision of simple
user profile information to RPs.
* "Attribute Exchange", which I'm not really following and don't know
much about.
...and obviously, there's a lot of debate about how RPs should determine
whether to trust particular IdPs and identifiers, but as far as I'm
aware no-one is working on any concrete proposals related to this right
now. I imagine this will become an area of focus for lots of people once
OpenID Authentication 2.0 is finished.
-------
[1] I personally would have preferred directed identity as a separate
spec, but there we go. You can't win 'em all. :)
_______________________________________________
security mailing list
<a class="moz-txt-link-abbreviated" href="mailto:security@openid.net">security@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/security">http://openid.net/mailman/listinfo/security</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>