<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
McGovern, James F (HTSC, IT) wrote:<br>
<blockquote
cite="mid:7E17878DC3BD7640949FBBE9F7FCABC6A0EBB3@AD1HFDEXC306.ad1.prod"
type="cite">
<pre wrap="">
The provider authentication policy extension handles half of this
already (telling you what checking the OP did). It does not cover the
trust issue though, so without a pre-existing trust relationship there
is no reason to believe the PAP assertions.
</pre>
</blockquote>
Right!<br>
<blockquote
cite="mid:7E17878DC3BD7640949FBBE9F7FCABC6A0EBB3@AD1HFDEXC306.ad1.prod"
type="cite">
<pre wrap="">
The trust side is something that would be interesting to see addressed
in future specs.
</pre>
</blockquote>
It has been brought up various times here without any success. Either
the OpenID designers have something very specific in mind for the
future in that respect (and which will come from outside the specs)
and/or the i-names/i-numbers will be the only game in town at some
point? Not sure, just guessing...<br>
<blockquote
cite="mid:7E17878DC3BD7640949FBBE9F7FCABC6A0EBB3@AD1HFDEXC306.ad1.prod"
type="cite">
<pre wrap="">
[JFM] Strongly agree here. OpenID needs to be used for more than just
blog sites and free email providers. If businesses who conduct commerce
in a B2B scenario were to embrace, the notion of trust needs to be
discussed.
</pre>
</blockquote>
Absolutely agree in both accounts here too. OpenID doesn't want to
address this issue (even it should so in some form). Even a
watered-down federation of OPs for white lists in order to tackle spam
was suggested previously...<br>
<br>
The only way to do that, as you indicate below, is by hand-picking the
OPs you trust. This can be one or many...<br>
<blockquote
cite="mid:7E17878DC3BD7640949FBBE9F7FCABC6A0EBB3@AD1HFDEXC306.ad1.prod"
type="cite">
<pre wrap="">
This is already possible with OpenID 2.0:
1. make the Sun OP provide an OP identifier URL that can be used to
initiate a directed identity request to authenticate any user of the OP.
2. to authenticate, the Sun employee store would initiate an OpenID
request against the URL from (1) rather than asking the user to enter an
identity URL.
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>