<html><head><base href="x-msg://1347/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I agree that where the access token is a JWT it must contain an audience restriction.<div><br></div><div>I would go further to say describing how to use JWT as access tokens is provably a valid topic for an extension spec.</div><div><br></div><div>What confused me is that you started off looking for a countermeasure to:</div><div><span class="Apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px; "><a name="section-4.6.4"><b><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; ">4.6.4</span></b></a></span><span class="Apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px; "><b><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; ">. Threat: Access token phishing by counterfeit resource server</span></b></span></div><div><font class="Apple-style-span" face="'Courier New'"><span class="Apple-style-span" style="font-size: 13px;"><b><br></b></span></font></div><div><font class="Apple-style-span" face="Verdana" size="2"><span class="Apple-style-span" style="background-color: transparent;">This is important but not a effective countermeasure to this attack.</span></font></div><div><font class="Apple-style-span" face="Verdana" size="2"><br></font></div><div><font class="Apple-style-span" face="Verdana" size="2">John<br></font><div><div>On 2011-11-14, at 9:15 AM, Mike Jones wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">No, I’m not proposing that the client understand anything about the audience in the access token. I’m proposing that the issuer of the access token include an audience restriction within the token stating that it is intended for consumption by the UserInfo endpoint for the OpenID Provider.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">This is standard audience semantics in which the intended recipient of a token is recorded in the audience claim of the token. Nothing complicated or special is intended.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Yes, let’s talk about it during today’s call.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> -- Mike<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span>[mailto:openid-specs-ab-bounces@lists.openid.net]<b>On Behalf Of<span class="Apple-converted-space"> </span></b>John Bradley<br><b>Sent:</b><span class="Apple-converted-space"> </span>Monday, November 14, 2011 3:20 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Anthony Nadalin<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] Audience restriction of access_token/resource ep response in OpenID Connect<o:p></o:p></span></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">From what I understand of Mike's proposal.<o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">He is proposing that the client also use information in the access token to determine what resources it can send the token to.<o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">This is a separate issue from the protected resource determining if it is the intended audience of the token.<o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Perhaps we can discuss it on today's call.<o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">John<o:p></o:p></div></div><div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">}On 2011-11-14, at 4:06 AM, Anthony Nadalin wrote:<o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br><br><o:p></o:p></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">></span><span class="apple-converted-space"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span></span><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I am ok with RECOMMENDing that these audience to be encoded in the access_token itself, but would like to let the implementors have choices on it</span><o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span><o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">Not sure what you mean by encoded in the access_token, I assume you mean that there is a aud_restriction claim in the token, not that the token is encoded somehow that the receiving parties can decode?</span><o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span class="apple-converted-space"><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "> </span></span><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><a href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span><a href="mailto:[mailto:openid-specs-ab-bounces@lists.openid.net]" style="color: blue; text-decoration: underline; ">[mailto:openid-specs-ab-bounces@lists.openid.net]</a><b>On Behalf Of<span class="apple-converted-space"> </span></b>Nat Sakimura<br><b>Sent:</b><span class="apple-converted-space"> </span>Thursday, November 10, 2011 5:04 PM<br><b>To:</b><span class="apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="apple-converted-space"> </span>[Openid-specs-ab] Audience restriction of access_token/resource ep response in OpenID Connect</span><o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> <o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span class="apple-style-span"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; ">Hi. </span></span><o:p></o:p></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">Currently, as it turns out in OpenID Connect, the way to audience restrict </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">the response of a resource endpoint is to encrypt the response </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">using the key of the intended client. The server has to keep track of </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">to whom the access_token was issued, i.e., client audience restriction, </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">and use the registration information of that client to find out the relevant key. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">By doing so, even if the request comes from a rogue party who phished the </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">legitimate client, the rogue party cannot read the response, so it is secure. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As to the resource endpoint audience restriction is concerned, </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is done implicitly in the sense that as the access_token is opaque, </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">only the intended endpoint can actually interprete and validate it. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">This is how the resource endpoint audience restriction is done </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in OAuth 2.0 as I understand. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "> </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As it is written right now, how to record both client and resource endpoint </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">audience restriction is an implementation detail. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I think it should remain implementation detail, but </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is worthwhile to note that somehow the audience restriction MUST be done. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I am ok with RECOMMENDing that these audience to be encoded </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in the access_token itself, but would like to let the implementors have </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">choices on it. </span><o:p></o:p></div></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> <o:p></o:p></div></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">--<span class="apple-converted-space"> </span><br>Nat Sakimura (=nat)<o:p></o:p></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank" style="color: blue; text-decoration: underline; ">http://nat.sakimura.org/</a><br>@_nat_en<o:p></o:p></div></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> <o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 13.5pt; font-family: Helvetica, sans-serif; ">_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></span></div></div></div><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "></p></div></div></div></span></blockquote></div><br></div></body></html>