Re: [OpenID] OpenID and phishing (was Announcing OpenID Authentication2.0 - Implementor's Draft 11)

2007-01-22 Thread Simon Willison 

On 19 Jan 2007, at 15:06, Scott Kveton wrote:

 What if the OP cataloged where you just came from and then  
 presented the
 screen that you mention?  The user is asked to navigate via a  
 bookmark or
 entering the URL in the location bar and then upon logging in is  
 presented
 with a link back to the site they just came from.  Then the user  
 can quickly
 engage and the site can still kick of the SREG mojo instead of  
 having to go
 _back_ to the site in question to re-initiate the login.

That's actually what I had in mind - I should have made that more  
clear. When you arrive on the landing page a cookie is set to allow  
the site to track your half-complete authentication request; once you  
log in you get a link to continue with that authentication.

I totally agree that the best thing about OpenID is that it lowers  
the barrier to engagement. My hope is that most users will be logged  
in to their OP most of the time, so they will actually very rarely  
see the landing page.

Cheers,

Simon
___
specs mailing list
specs@openid.net
http://openid.net/mailman/listinfo/specs

Re: [OpenID] OpenID and phishing (was Announcing OpenID Authentication2.0 - Implementor's Draft 11)

2007-01-19 Thread Scott Kveton 
 Still totally unhappy about the phishing issues, which I blogged
 about here:
 
 http://www.links.org/?p=187
 
 I have a proposal which I think could greatly reduce the risk of
 phishing: identity providers should /never/ display their login form
 (or a link to the form) on a page that has been redirected to by an
 OpenID consumer.
 
 Instead, they should instruct the user to navigate to the login page
 themselves. The login page should have a short, memorable URL and
 users should be encouraged to bookmark it themselves when they sign
 up for the provider. The OpenID landing page then becomes an
 opportunity to help protect users against phishing rather than just
 being a vector for the attack.
 
 I've fleshed this out on my blog:
 
 http://simonwillison.net/2007/Jan/19/phishing/
 
 Does that sound workable?

One of the greatest strengths of OpenID is the ability for website operators
to lower the barrier to engagement ... User shows up, user enters OpenID,
user is then immediately participating in discussion/posts/comments/etc.
I'm afraid this proposal takes away from that by forcing the user to lose
the flow ... Of course its that flow that is the problem in terms of
phishing.

What if the OP cataloged where you just came from and then presented the
screen that you mention?  The user is asked to navigate via a bookmark or
entering the URL in the location bar and then upon logging in is presented
with a link back to the site they just came from.  Then the user can quickly
engage and the site can still kick of the SREG mojo instead of having to go
_back_ to the site in question to re-initiate the login.

Would that work or am I missing something obvious?

- Scott

___
specs mailing list
specs@openid.net
http://openid.net/mailman/listinfo/specs