RE: Special Request: Client Certificates vs. OpenID

2007-01-23 Thread McGovern, James F \(HTSC, IT\)
Even if we don't produce a white paper, we should at least produce enough insight that others such as industry analysts can provide the white paper writing services and blogging is a great way to make this happen. We should talk about the following: 1. How OpenID can benefit enterprises -

RE: [OpenID] Questions about Spoofing OpenId

2007-01-23 Thread David Fuelling
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Carl Howells Subject: Re: [OpenID] Questions about Spoofing OpenId Some care has to be taken to make sure that direct cross-linking won't work, but that's not too difficult. What do you mean by

RE: 2.0 Spec Questions

2007-01-23 Thread Recordon, David
James, for 3 have you looked at http://openid.net/specs/openid-assertion-quality-extension-1_0-03.html? I don't think it addresses the specific point you brought up, though may be the right place to do it. --David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On

Re: OpenID Auth 2.0 security considerations

2007-01-23 Thread Johannes Ernst
Me too ;-) There are tradeoffs, no question -- and I used the verb suggest to indicate only a weak preference, on balance. On Jan 23, 2007, at 14:19, Hallam-Baker, Phillip wrote: I get really worried whenever I see such statements. They tend to be the sign of a long drawn out

Re: [OpenID] Announcing OpenID Authentication 2.0 - Implementor'sDraft 11

2007-01-23 Thread James A. Donald
-- James A. Donald nor is PKI useful in solving phishing. PKI is a solution that has been tried and has failed. It has become an obstacle, as commercial interests actively block alternatives that do not involve a small number of centralized authorities with a special

Re: [OpenID] Announcing OpenID Authentication 2.0 - Implementor'sDraft 11

2007-01-23 Thread James A. Donald
-- Ka-Ping Yee [mailto:[EMAIL PROTECTED] In practice SSL is primarily used to establish an encrypted channel between endpoints, not to establish reliable reciprocal identification. Given that almost no users pay any attention to certificates, what reason do we have to believe that