<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Diva,<BR>
<BR>
while I know you've made your last post on the point, I just wanted to tell you I'm in 100% agreement. I had heard talk about the weakness of openId before, but never really looked into it.<BR>
<BR>
This just amazes me.<BR>
<BR>
Technicians really believe that we won't see forms posting to malicious pop-ups that has removed and/or substituted all browser UI? Counting on the end-user to know exactly what experience to expect, what icons to click to secure ceritificates?<BR>
<BR>
If this is really how openId is supposed to work, if you're really supposed to be _told_ where and how to go to authenticate by _the_very_party_ you're trying to authenticate against...<BR>
<BR>
Amazing.<BR>
<BR>
Now, I won't comment further either. I believe it's more important to get ANY security scheme in place than to get the RIGHT one in place.<BR>
<BR>
Let's just make sure it's pluggable.<BR>
<BR>Best regards,<BR>Stefan Andersson<BR>Tribal Media AB<BR><BR><BR><BR> <BR>> Date: Tue, 3 Mar 2009 16:53:08 +0900<BR>> From: mmazur@gmail.com<BR>> To: opensim-dev@lists.berlios.de<BR>> CC: ralf@ralf-haifisch.biz<BR>> Subject: Re: [Opensim-dev] OpenID<BR>> <BR>> Hi,<BR>> <BR>> On Tue, 3 Mar 2009 08:40:03 +0100<BR>> "Ralf Haifisch" <ralf@ralf-haifisch.biz> wrote:<BR>> <BR>> > beiing pished - you are talking about "getting the users token" ?<BR>> <BR>> The expected scenario is this:<BR>> <BR>> 1. Log into travel.com using OpenID<BR>> 2. travel.com redirects you to myopenid.com for you to enter your pwd<BR>> 3. You enter your valid OpenID password<BR>> 4. myopenid.com redirects you back to travel.com, you are now authed<BR>> 5. You book your ticket safely<BR>> <BR>> The phishing scenario is this:<BR>> <BR>> 1. Log into travol.com using OpenID<BR>> 2. travol.com redirects you to BADopenid.com for you to enter your pwd.<BR>> BADopenid.com looks just like myopenid.com, you don't notice the<BR>> different URL and the lack of SSL session<BR>> 3. You enter your valid OpenID password<BR>> 4. Now the bad guys have access to your OpenID account, and all the<BR>> services you use OpenID to authenticate with<BR>> <BR>> Mike<BR>> _______________________________________________<BR>> Opensim-dev mailing list<BR>> Opensim-dev@lists.berlios.de<BR>> https://lists.berlios.de/mailman/listinfo/opensim-dev<BR></body>
</html>