<HTML>
<HEAD>
<TITLE>Re: [security] Nonrepudiation, and Trusting OpenID Providers</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>So once banks accept OpenID, banks will require that OPs authenticate users using “strong auth”, using mechanisms that are agreed upon by both the the OP and the bank.<BR>
<BR>
Allen<BR>
<BR>
On 12/9/09 7:46 PM, "Brandon Ramirez" <<a href="brandon.s.ramirez@gmail.com">brandon.s.ramirez@gmail.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
<BR>
In other words, I personally trust Google not to reset my passwords. My bank, however, why should they trust Google? Or Joe-Shmo-Provider?<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>