<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">There is no particular security problem with OpenID 2.<div class=""><br class=""></div><div class="">It wasn’t designed to support mobile applications, but is still fine for server based authentication.</div><div class=""><br class=""></div><div class="">Mostly the issue is people wanting to do OAuth for other reasons.</div><div class=""><br class=""></div><div class="">We did have a openID 2/OAuth hybrid flow but it was not efficient or pretty.</div><div class=""><br class=""></div><div class="">Connect also has some additional security features that are useful to secure plain OAuth.</div><div class=""><br class=""></div><div class="">In terms of security Connect can support LoA 3 by default and openID 2 was LoA 2 (modulo some politics) capable.</div><div class=""><br class=""></div><div class="">The main difference between 2 and 3 is not really a security one, but has to do with supporting a asymmetric signature for non repudiation of transactions.(a policy reason)</div><div class=""><br class=""></div><div class="">Nat and I started out trying to modify openID 2 to add artifact binding and asymmetric signatures, and basically the group opinion was that it was best to start clean with OAuth 2 as a base.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On May 19, 2015, at 12:54 PM, Kim, William G <<a href="mailto:wkim@mitre.org" class="">wkim@mitre.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">Apologies if this is not the right forum for this question. Is there a short answer for this? If not, is there any literature online or some threads on the mailing list that you can point me to regarding why OpenID 2.0 was obsoleted/deprecated in favor
of a whole new protocol?</div>
<div class=""><br class="">
</div>
<div class="">AFAIK, I would surmise that it was due to practical reasons that people were doing OAuth 2.0 for authentication instead anyways, so OIDC was born to standardize that process. But I've also heard that OpenID 2.0 was ditched due to irreconcilable security
issues in the protocol itself. If the latter is true, I can't seem to find any reasonable explanations online for what they are and why, except for all the hubbub about covert redirects which I know is not a problem specific to OAuth or OpenID.</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">William</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></blockquote></div><br class=""></div></body></html>