Hi Thomas,<div><br></div><div>The current thinking here, is that OpenID is all about synchronous signatures. Which I happen to agree with. So we need to work within the framework. Disclaimer: I am not an expert here, this is only my understanding. Anyone please correct me if I am wrong.</div>
<div><br></div><div>Thanks</div><div>Santosh</div><div><br><br><div class="gmail_quote">On Thu, Dec 10, 2009 at 9:00 PM, Thomas Hardjono <span dir="ltr"><<a href="mailto:hardjono@mit.edu">hardjono@mit.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hi folks,<br>
<br>
I'm jumping in late to this discussion (apologies).<br>
<br>
I was wondering of OpenID providers (or those wanting<br>
to be one) have plans to publish something equivalent<br>
to a PKI Certificate Practices Statement?<br>
Something like VeriSign's CPS statement:<br>
<a href="https://www.verisign.com/repository/cps/index.html" target="_blank">https://www.verisign.com/repository/cps/index.html</a><br>
<br>
Most folks that I've met either don't know about CPS docs or<br>
belittle it as something bureaucratic. But its actually<br>
an all-important doc that Enterprise-CA customers<br>
of VeriSign take into serious consideration when<br>
signing-up for services.<br>
<br>
In the Idp/OpenID context, I'm finding it kind of<br>
difficult to imagine signing-up<br>
to an IdP without something equivalent.<br>
The approach of "just trust us since we already have<br>
your credit score and other financial information"<br>
will not fly (and may become the failure point for<br>
rolling out IdP/OpenID services). Especially with the<br>
ongoing loss of customer data by various<br>
organizations without much penalties.<br>
<font color="#888888"><br>
/thomas/<br>
</font><div><div></div><div class="h5"><br>
_______________________________________________<br>
security mailing list<br>
<a href="mailto:security@lists.openid.net">security@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-security" target="_blank">http://lists.openid.net/mailman/listinfo/openid-security</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><a href="http://hi.im/santosh">http://hi.im/santosh</a><br><br><br>
</div>