<html><head><title>Re: Review of Proposed Implementer’s Draft of OpenID 2.0 to OpenID Connect Migration Specification</title>
<META http-equiv=Content-Type content="text/html; charset=utf-8">
</head>
<body>
<span style=" font-family:'Calibri'; font-size: 12pt;">Hi Nat,<br>
<br>
Yeah, two-step (TOTP) blocks keyloggers, not phishing (TOTP was invented in 1984, before we had networks and real-time attacks). breakins worldwide have doubled in the last 12months, and risen 800% in the banking industry, almost exclusively on the back of phishing... risk-based and multifactor are both widespread, and absolutely not working (and don't get me started on the stupidity of "risk based" - the false positives are making the internet unusable for travelers and other legit people, and having no effect whatsoever on crime).<br>
<br>
The protocol is the cause of the problem. It's one-way-only, which is why phishing is working so well. It's not enough to authenticate a user to a site, the opposite needs to take place as well, at the same time, as part of the protocol.<br>
<br>
Kind Regards,<br>
Chris Drake<br>
<br>
<br>
Thursday, September 25, 2014, 6:12:01 AM, you wrote:<br>
<br>
</span><table>
<tr>
<td width=2 bgcolor= #0000ff><br>
</td>
<td><span style=" font-family:'calibri'; font-size: 12pt;">Most large providers, as I understand, are using risk based authentication and also offers two-step or two-factor authentication. <br>
So, simply stealing password would not work: they are phishing resistant.<br>
It looks more like a deployment issue than a protocol issue to me. <br>
Correct me if I am wrong. <br>
<br>
Man-in-the-browser attack is something else. It needs continuous or second channel authentication. This looks more interesting from a protocol point of view. <br>
<br>
Nat<br>
<br>
2014-09-25 2:14 GMT+09:00 Chris Drake <</span><a style=" font-family:'calibri'; font-size: 12pt;" href="mailto:christopher@pobox.com">christopher@pobox.com</a><span style=" font-family:'calibri'; font-size: 12pt;">>:<br>
Hi Nat,<br>
<br>
I remember back when the original OpenID was forming, and a bunch of my suggestions got shoved "out of scope"... which are now being brought back in to scope via OpenID Connect. It's cold comfort, but at least I get to brag "I told you so" after the fact:-)<br>
<br>
Scratch the surface of any megahack, and 9 times out of 10 it was caused by phishing. Personally, I don't see the point wasting effort on OpenID Connect when it's merely going to exacerbate what is already a crippling problem.<br>
<br>
There's a bunch of smart and experienced people on this list - they should put their heads together and use the power and knowledge present to fix what is reported at being behind 91% of the worlds security problems, most especially when OpenID users are significantly more vulnerable to these attacks, and at-risk once attacked. "Get it right" is better than "get it now" IMHO.<br>
<br>
Kind Regards,<br>
Chris Drake<br>
<br>
<br>
<br>
Wednesday, September 24, 2014, 9:57:03 PM, you wrote:<br>
<br>
</span><table>
<tr>
<td width=2 bgcolor= #0000ff><br>
</td>
<td><span style=" font-family:'calibri'; font-size: 12pt;">The authentication mechanism itself is out of scope. <br>
You can, as an OP, select whatever the authentication mechanism you may want to use. <br>
OpenID Connect is concerned about transferring the information around the authentication event to another party. <br>
It is a federation protocol. <br>
<br>
Nat<br>
<br>
2014-09-25 1:17 GMT+09:00 Chris Drake <</span><a style=" font-family:'calibri'; font-size: 12pt;" href="mailto:christopher@pobox.com">christopher@pobox.com</a><span style=" font-family:'calibri'; font-size: 12pt;">>:<br>
Hi,<br>
<br>
Can anyone tell me if any kind of mutual-authentication or other kind of phishing-protection is present anywhere in the specs?<br>
<br>
Kind Regards,<br>
Chris Drake<br>
<br>
<br>
<br>
-- <br>
Nat Sakimura (=nat)<br>
Chairman, OpenID Foundation<br>
</span><a style=" font-family:'calibri'; font-size: 12pt;" href="http://nat.sakimura.org/">http://nat.sakimura.org/</a><br>
<span style=" font-family:'calibri'; font-size: 12pt;">@_nat_en</td>
</tr>
</table>
<br><br>
<br>
<br>
<br>
<br>
<br>
<span style=" font-family:'calibri'; font-size: 12pt;">-- <br>
Nat Sakimura (=nat)<br>
Chairman, OpenID Foundation<br>
</span><a style=" font-family:'calibri'; font-size: 12pt;" href="http://nat.sakimura.org/">http://nat.sakimura.org/</a><br>
<span style=" font-family:'calibri'; font-size: 12pt;">@_nat_en</td>
</tr>
</table>
<br><br>
<br>
</body></html>