Subject: [dix] New draft on anti-phishing requirements

From: Sam Hartman <[email-masked]>
Date: Mon, 22 May 2006 10:28:08 -0400

Hi folks.

One thing that concerns me thinking about authentication and identity
on the web is how to make sure that we don't make phishing worse and
in fact to make sure that we significantly improve it.  I've written a
draft on requirements for web authentication solutions to minimize
phishing risk.  That draft has been submitted but is not yet in the ID
repository so I'm attaching a copy.

I believe that DIX, my proposal or anything else in this space needs
to meet these requirements or requirements that are very similar.
Some of these requirements apply to the protocol used between an
identity provider and a subject to authenticate to the identity
provider.  Other requirements apply to protocols used to carry
authentication or identity information between identity providers and
relying parties.  Some requirements apply to both.  The line is a bit
blurry in some solutions.

Comments are welcome.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix