<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Balasubramanian,<div><br></div><div>It's pretty difficult to answer your question for a couple reasons.</div><div><br></div><div>First, there is a very large gradient between secure and insecure, and every application falls somewhere on that spectrum. You really need to assess how much security is really necessary so you can balance security with usability. There are a lot of attempts out there to build frameworks to help you analyze the quality of authentication and attributes your application needs. You can probably find one. Here is an old example for the U.S. Federal government:</div><div><br></div><div><a href="http://www.whitehouse.gov/omb/memoranda/fy04/m04-04.pdf">http://www.whitehouse.gov/omb/memoranda/fy04/m04-04.pdf</a></div><div><br></div><div>Second, there really is no way to gauge the security of any individual OpenID transaction because there is no trust framework. You're relying on the OP to do good identity-proofing, but there's incredible variability in OP's. Some just require a non-bouncing email, while others do identity proofing. Some do better authentication, like Kevin mentioned, and others are plaintext passwords over HTTP. There are some attempts at addressing this variety, like PAPE, but without any trust framework, you're still ultimately relying on the OP to just be honest. I hope upcoming work in the OpenID community will build support for trust frameworks.</div><div><br></div><div>Hope this helps,</div><div>Nate.</div><div><br><div><div>On 09 Feb 2009, at 19:02, Balasubramanian G wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; ">Dear all,<br><br>I recently started working upon making my site openid enabled. when i was having a talk with my friend abt this, he pointed a series of articles in the internet which describe the vulnerabilities in using openid. Though my site does not deal with any sensitive data, i just want to make sure that its safe to the users if not 100%, atleast to the max extent.<br><br>So, pls advise me on how secure is openid and wht safety measures should i implement in order to make it more safe as i am answerable to the users of my site if they raise the question of security.. Reply ASAP<br><br clear="all">Warm Regards<br>Balasubramanian</span></blockquote></div><br></div></body></html>