<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: XAuth critiques</title></head><body>
<div>>(2) If an eavesdropper can listen in on all your network
traffic, can't they see your HTTP requests to IdP and RP (and
everything else) directly?</div>
<div><br></div>
<div>Even setting aside the IP address versus sniffing request strings
versus sniffing responses too, you've blanked out here on the idea of
"Assume that ALL requests are protected with SSL" - it's one
thing to be blind to anything which would contradict your favored
belief, but when it starts to affect your logical faculty in other
areas, you seriously need to take a step back and detach.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>