Special Request: Client Certificates vs. OpenID

Tue Jan 23 16:23:01 UTC 2007

Even if we don't produce a white paper, we should at least produce enough insight that others such as industry analysts can provide the white paper writing services and blogging is a great way to make this happen. We should talk about the following:

1. How OpenID can benefit enterprises - enough on the consumerish stuff. Besides, success should not be based on just amount of eyeballs but where the money is.
2. What would industry vertical approaches look like using user-centric approaches - Yes we can be compatible with PKI but how about focusing on the "instead of" scenarios
3. A discussion on who is willing to pay - Stolen from Dick - I am of the belief that consumers won't pay and therefore putting into business context is the only way to make money. 
4. If businesses are willing to pay, then what do they require and how to they beneift - anti-phishing, authorization, relationships, etc
5. How should enterprise architecture teams start thinking about identity - it needs to move away from just security folks talking about it in terms of protection mechanisms towards something that becomes a business enabler

If we blog heavily on identity, relationships, authorization and attestation and the analysts need some additional stimulus to publish on it, then I will pick up expenses associated with making this happen as long as we do so quickly and in a more aggressive manner.

-----Original Message-----
From: Johannes Ernst [mailto:jernst+openid.net at netmesh.us]
Sent: Monday, January 22, 2007 3:19 PM
To: McGovern, James F (HTSC, IT)
Cc: specs at openid.net
Subject: Re: Special Request: Client Certificates vs. OpenID

So I've been doing some asking around who might be interested in co-authoring some kind of white paper on the subject of user-centric identity in/for the enterprise. There are some volunteers with a variety of view points -- no guarantees that we'll manage to produce something collaboratively (cross-vendor white papers tend to be hard) -- and we'll see where that goes. 

That only goes partially to your point, but it is a step.

On Jan 22, 2007, at 9:08, McGovern, James F ((HTSC, IT)) wrote:

Last week I sent a note to the list inquiring whether anyone on this list wanted to participate in our industry vertical standards body in hopes of ratifying OpenID as an endorsed horizontal specification. In terms of preparation, it would be greatly appreciated if Dick Hardt, Johannes Ernst and other bloggers could from their blog discuss user-centric identity as a potential solution to industry vertical concerns since nothing neutral (produced by a vendor and not an insurance carrier) exists in this regard.

Other industry verticals such as Pharmaceutical have embraced PKI approaches where they issue client certificates to participants. Many PKI vendors have in secret created user certificate management issues, the inability to allow for roaming users, sharing of desktops, and other concerns that I am of the belief that user-centric approaches could handle. Of course PKI-centric and user-centric don't have to be mutually exclusive but it would be wonderful if the blog entry reflected how approaches such as SAFE (pharma) would have looked in a user-centric world.

*************************************************************************
This communication, including attachments, is
for the exclusive use of addressee and may contain proprietary,
confidential and/or privileged information. If you are not the intended
recipient, any use, copying, disclosure, dissemination or distribution is
strictly prohibited. If you are not the intended recipient, please notify
the sender immediately by return e-mail, delete this communication and
destroy all copies.
*************************************************************************

_______________________________________________
specs mailing list
specs at openid.net
http://openid.net/mailman/listinfo/specs

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs/attachments/20070123/a4efeadb/attachment-0001.htm>