<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16788" name=GENERATOR><!--[if !mso]>
<STYLE>v\:* {
BEHAVIOR: url(#default#VML)
}
o\:* {
BEHAVIOR: url(#default#VML)
}
w\:* {
BEHAVIOR: url(#default#VML)
}
.shape {
BEHAVIOR: url(#default#VML)
}
</STYLE>
<![endif]-->
<STYLE>@font-face {
font-family: Helvetica;
}
@font-face {
font-family: Tahoma;
}
@page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P {
FONT-SIZE: 12pt; MARGIN-LEFT: 0cm; MARGIN-RIGHT: 0cm; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto
}
SPAN.EmailStyle18 {
COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-AU
style="WORD-WRAP: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space"
vLink=purple link=blue>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>James,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>I am totally in favor of enabling consumers to make their
own choice of OP and who they trust. </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>If we are considering low or "zero" value transactions
then RPs that are utilizing these openids should utilize the broadest set of OPs
possible. However, the identity space is not uniform - not even the consumer
identity space. There are in fact large swathes of relying parties that have
different needs.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>The problem is that while consumers are free to choose
whatever OP they want, a whole range of RPs are not free to accept just any
identities produced by any OP. At the farther end of the spectrum, If you are a
financial institution with "know your customer" regulations or a health care
provider with HIPAA will significantly restrict the set of OPs you may be able
to rely on. Given that an OP is providing an authentication service and
attesting to the consistency of the identity and user that is being presented (
leaving other KYC issues aside), the effectiveness with which an OP is run and
how that figures into your risk processing is a completely valid
concern.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>For merchants or other RPs that fit somewhere through the
middle of the identity continuum, they will make choices of OPs based on their
own fraud/risk/security criteria. I don't see how we can say we want them to use
OpenID without allowing the RPs as much freedom to make choices about
appropriate OPs based on the identity proofing, management, authentication, risk
analysis or whatever else is required for the RP operate successfully.
</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=458405615-10022009><FONT face=Arial
color=#0000ff size=2>Engagement with Relying Parties is one of our bigger
challenges - part of the reason is that we need to provide appropriate support
for them in the area of trust - unless we decide as a community that we want
OpenID to be restricted to a subset of relying parties.</FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=458405615-10022009>Even in </SPAN>Balasubramanian<SPAN
class=458405615-10022009>'s case operating a "non-profit" he </SPAN><SPAN
class=458405615-10022009>is making risk based assessments and trying to work out
appropriateness of OpenID as a solution for his needs. He is dealing with
standard issues relating to transaction velocity and potential account spoofing
in various ways. These are totally valid concerns that we do need to openly
discuss and address. </SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=458405615-10022009></SPAN></FONT></FONT></FONT><FONT face=Arial><FONT
color=#0000ff><FONT size=2><SPAN
class=458405615-10022009></SPAN></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=458405615-10022009>The merits and values (and even potential enhancements
to OpenID) must be open to discussion or we are in danger of becoming a
religious debate. It should not matter if Nate is Nat or Nate, a board member or
not. If this is an open community then lets just talk about the issues with some
level of respect.</SPAN></FONT></FONT></FONT><BR></DIV>
<DIV><SPAN class=458405615-10022009><FONT face=Arial color=#0000ff size=2>To be
quite clear (as I am sure this has potential for misinterpretation) - I am
totally supportive of the user centric aspects of OpenID. However, if we want to
be effective in dealing with even moderately complex uses of OpenID moving
forward, these issues of security and trust need to be
addressed.</FONT></SPAN></DIV><!-- Converted from text/rtf format -->
<P><SPAN lang=en-us><FONT face=Arial size=2>--Andrew</FONT></SPAN> </P>
<DIV> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> security-bounces@openid.net
[mailto:security-bounces@openid.net] <B>On Behalf Of </B>Manger, James
H<BR><B>Sent:</B> Monday, February 09, 2009 6:53 PM<BR><B>To:</B>
security@openid.net<BR><B>Subject:</B> Re: [security] how secure is openid?
advise pls..<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Nate, please accept my
apologies for mistaking you for Nat (whose is a board member); and similar
apologies to Nat.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Nate,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">It looks like we both
agree that whitelisting OPs “breaks” OpenID to some degree. I didn’t want that
“break” to be so easily (even if reluctantly) accepted for what appeared to be a
“general” consumer Internet web site (not banking, health,
corporate…).<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<DIV>
<P><FONT face="Times New Roman" color=navy size=3><SPAN
style="FONT-SIZE: 12pt; COLOR: navy"><A
href="http://peoplesearch.in.telstra.com.au/peoplesearch/UserDetail.aspx?EmployeeNumber=3799878"><B><FONT
face=Arial><SPAN style="FONT-WEIGHT: bold; FONT-FAMILY: Arial">James
Manger</SPAN></FONT></B></A> <BR><A
href="mailto:James.H.Manger@team.telstra.com"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">James.H.Manger@team.telstra.com</SPAN></FONT></A>
<BR></SPAN></FONT><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Identity and security
team</SPAN></FONT><FONT color=navy><SPAN style="COLOR: navy">
</SPAN></FONT><FONT face=Tahoma color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Tahoma">—</SPAN></FONT><FONT
face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> Chief Technology
Office</SPAN></FONT><FONT color=navy><SPAN style="COLOR: navy">
</SPAN></FONT><FONT face=Tahoma color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Tahoma">—</SPAN></FONT><FONT
face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">
Telstra</SPAN></FONT><FONT color=navy><SPAN style="COLOR: navy">
<BR><BR></SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN lang=EN-US style="FONT-SIZE: 12pt">
<HR tabIndex=-1 align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><B><FONT face=Tahoma size=2><SPAN lang=EN-US
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN lang=EN-US
style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma"> Nate Klingenstein
[mailto:ndk@internet2.edu] <BR><B><SPAN
style="FONT-WEIGHT: bold">Sent:</SPAN></B> Tuesday, 10 February 2009 12:53
PM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> Manger, James
H<BR><B><SPAN style="FONT-WEIGHT: bold">Cc:</SPAN></B> security@openid.net;
Balasubramanian G<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re:
[security] how secure is openid? advise pls..</SPAN></FONT><SPAN
lang=EN-US><o:p></o:p></SPAN></P></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">James,<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><BR><BR><o:p></o:p></SPAN></FONT></P>
<P style="MARGIN: 0cm 0cm 0pt"><FONT face=Helvetica size=1><SPAN
style="FONT-SIZE: 9pt; FONT-FAMILY: Helvetica">NO!</SPAN></FONT><o:p></o:p></P>
<P style="MIN-HEIGHT: 14px; MARGIN: 0cm 0cm 0pt"><FONT face=Helvetica
size=1><SPAN
style="FONT-SIZE: 9pt; FONT-FAMILY: Helvetica"><o:p> </o:p></SPAN></FONT></P>
<P style="MIN-HEIGHT: 14px; MARGIN: 0cm 0cm 0pt"><FONT face=Helvetica
size=1><SPAN
style="FONT-SIZE: 9pt; FONT-FAMILY: Helvetica"><o:p> </o:p></SPAN></FONT></P>
<P style="MARGIN: 0cm 0cm 0pt"><FONT face=Helvetica size=1><SPAN
style="FONT-SIZE: 9pt; FONT-FAMILY: Helvetica">Restricting users to only "some
trusted OPs" absolutely breaks the core user-centric identity concept on which
OpenID is built.</SPAN></FONT><o:p></o:p></P>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Please re-read Balasubramanian's comments. My
response was, "yes, it does break one of the rules of thumb," with the addition
that many other things are threatening those concepts today as
well.<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P style="MARGIN: 0cm 0cm 0pt"><FONT face=Helvetica size=1><SPAN
style="FONT-SIZE: 9pt; FONT-FAMILY: Helvetica">That must not be done lightly.
It should not be the first suggestion (particularly from an OpenID board
member) without knowing the specifics of a particular web site and its users.
Such restrictions might be appropriate for some specialist Relying Parties,
but they should be the exceptions, not the
norm.</SPAN></FONT><o:p></o:p></P></BLOCKQUOTE>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">I'm certainly not a board member, was not nominated,
would be flattered but refuse to serve if nominated, and wonder whether you
meant someone else.<o:p></o:p></SPAN></FONT></P></DIV></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Take care,<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Nate.<o:p></o:p></SPAN></FONT></P></DIV></DIV></BODY></HTML>