Subject: RE: [dix] Re: Dix & OpenId?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 9 Aug 2006 09:27:48 -0700

> From: Dan Connolly [mailto:[email-masked]] 

> Yes... it's clear to me how I can use an OpenID persona in 
> the bloggy wiki world, but I also want to use it for calendar 
> synchronization, banking and bill paying and getting credit 
> card statements...
> maybe even with OFX and quicken. I can't seem to work that 
> out in my head.

OK lets look at what is reachable. 

Blogs, Wikis          - More than sufficient today.
HR related extranet   - Probably acceptable, need security analysis
Purchasing extranet   - Possibly with many constraints
Frequent flyer        - Some issues to consider
Online banking        - Faces major issues of liability

> Is this a case of "doctor, doctor, it hurts when I do that; so don't"?
> Or does anybody expect that it will, in fact, scale up? Any 
> pointers to reading material would be appreciated.

I think it can be made to scale up, the question is having to do the application specific security analysis for each case. This is not about the protocol security, phishing has proved that security of the application is not just about transport security. We need to do a security review for each application.

In the bloggy, wiki world the value of the ability to make comments is clearly greater than zero but I have a hard time seeing much of a motivation. In the banking application we are going up against criminal gangs currently making up to $50 million per year.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: "Recordon, David" <[email-masked]>
Date: Wed, 9 Aug 2006 18:05:08 -0700

Ah, glad the meeting was mentioned here as well.  Sorry I forgot about
that.

Tomorrow I'll be hosting another OpenID get together along with JanRain
and Sxip.  It will start at 10am and run through the afternoon when
we'll then migrate to the OpenID 2.0 event hosted by Dabble that evening
in Berkeley (http://www.kaliyasblogs.net/Iwoman/?p=401).  Agenda is
mainly focused around solidifying the Authentication spec and it should
be a good day of discussion like last time.

Address is 675 E Middlefield Road in Mountain View; look for building
five on the VeriSign campus.  Please just shoot me an email letting me
know if you're going to join us.  Hope to see you there! 

--David

-----Original Message-----
From: Dick Hardt [mailto:[email-masked]] 
Sent: Wednesday, August 09, 2006 7:52 AM
To: David Fuelling
Cc: 'Digital Identity Exchange'
Subject: [dix] Re: Dix & OpenId?

On 9-Aug-06, at 7:14 AM, David Fuelling wrote:
> The OpenId 2.0 draft spec has many similar components to the DIX draft

> 1 (pre-saml) spec.  In addition, it looks like Sxip Identity is a 
> founding sponsor of the OpenId bounty program, which seems a bit 
> counter-intuitive to me (although I can see the motivation of wanting 
> to publicize Identity 2.0 in general).  Regardless, Sxip Identity has 
> based Sxip 2.0 on dix, and has been a major backer of dix.
Hi David

The timing of your question is impeccable!

The Sxip people are working with incorporating much of DIX into OpenID
2.0. There have been a number of backroom conversations going on
(mostly with the folks at JanRain and David Recordon of VeriSign) and
there is a meeting at VeriSign's Mountain View offices tomorrow if
anyone on this list is interested in attending.

Converging the protocols seems to make the most sense (features from
each were being incorporated in the other anyway)

-- Dick