<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Feb 23, 2021, at 6:02 AM, Kristina Yasuda via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><div style="margin-top: 0px; margin-bottom: 0px;" class="">How would the RP check that it is a true "PWA / cloud wallet provider" and not a malicious provider pretending to be a good one?</div></div></div></blockquote></div><br class=""><div class="">The RP today does not have a way to verify an OP today isn’t a malicious one - the user is expected to select the OP that represents them and to choose a non-malicious OP.</div><div class=""><br class=""></div><div class="">Are you thinking of a particular attack scenario involving something like Phishing or Man-in-the-Middle?</div><div class=""><br class=""></div><div class="">-DW</div></body></html>