<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: XAuth critiques</title></head><body>
<div>>I don't see how that follows.</div>
<div><br></div>
<div>Refer to Peter Watkin's response, which has caught on the same
point.</div>
<div><br></div>
<div>>You seem to think a non-browser-centric version is
"broken", but you haven't explained why you think
that.</div>
<div><br></div>
<div>It isn't decentralized (you have admitted this yourself!).</div>
<div><br></div>
<div>>Specifically, I haven't seen a privacy issue which is simply
'solved' by moving responsibility into the browser.</div>
<div><br></div>
<div>Integrating static JS code into the browser would make each
client into the repository of its own XAuth script, instead of relying
on a central site to download code from.</div>
<div><br></div>
<div>>No, I'm saying it works as advertised,</div>
<div><br></div>
<div>You're advertising it as "does not break privacy".
There is a disconnect here between how you declare it to be Right Now,
and how your blog post explains that it will only be *if and when the
browser vendors change their browsers to include support*.</div>
<div><br></div>
<div>From your reply to Peter's questions:</div>
<div>>Sure, we could host extensions at <a
href="http://xauth.org">xauth.org</a>. And then people could
download them. From, um, a centralized site. How is that
more decentralized exactly?</div>
<div><br></div>
<div>EXACTLY!!!</div>
<div><br></div>
<div>This is how you are doing things RIGHT NOW.</div>
<div><br></div>
<div>THAT is what makes XAuth broken.</div>
<div><br></div>
<div>-Shade</div>
<div><br></div>
<div>Postscript: I'll quote from the blog post - "Objection:
The implementation relies on a single domain. Answer: The
current implementation does this" (excerpt terminated just after
you admit that XAuth's decentralization is broken Right Now and just
before you attribute this to limitations that browsers have Right
Now).</div>
</body>
</html>