Email address obfuscation in effect -- please
click here to turn it off.
[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
On Mon, 3 Dec 2007, ryan woodsmall wrote:
OpenID is promising, but there are security issues with their trust
model, phishing and man-in-the-middle attacks.
Do you have any good resources? I found this and it makes good sense to
me:
http://usablesecurity.com/2007/01/20/phishing-and-openid/
OpenID isn't usable by itself right now; other, more secure SSO
solutions are required to front-end it give you any form of security
whatsoever. I've looked at it, but there's no way I'd roll it out in
production without some decent security studies.
That's key -- I want studies. I want confidence. These guys are supposed
to be pros, but their recommendation was a sort of "trust me on this one."
I'm glad I'm skeptical!
Mike
_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members
Home | FAQ | Server | Presentations | Mailing Lists/Archives | Member Tools | Links | Sponsors | Contact