Message-ID: <6905b1570803240140l7f16331dt9c397cd7a79318c6@mail.gmail.com>
Date: Mon, 24 Mar 2008 08:40:23 +0000
From: "Petko D. Petkov" <pdp.gnucitizen@...glemail.com>
To: reepex <reepex@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: OpenID. The future of authentication on the
	web?

deer reepex,

every single time. :) yet another prove that you are troll. why don't
you come up with something constructive for a change? the email thread
reads "OpenID. The future of authentication on the web?" not "how to
troll full-disclosure, reepex style!!!!". FYI, do you research and
show examples next time before pointing fingers. as you can see yours
and your friends' useless comments did not got moderated out. And yes
the blogsphere is gigantic and it has many useful, troll free blogs
that provide good information resources and discussion grounds for
everybody, even you.

Kind Regards,
pdp

On Sun, Mar 23, 2008 at 10:33 PM, reepex <reepex@...il.com> wrote:
> thats right pdp  - go run to your protected lists and blogs where you don't
> have to hear anything negative and where you can flame people without
> contest who talk against you.
>
> you are another Bill O Reilly and everyone thinks of you as such. enjoy your
> sheep.
>
>
>
>
> On Sun, Mar 23, 2008 at 9:52 AM, Petko D. Petkov
> <pdp.gnucitizen@...glemail.com> wrote:
> > Hi Steven,
> >
> > I guess most 1337 hax0rs will flame you on this list. There are good
> > security blogs you can follow and learn from instead. Full-disclosure
> > is for rants and bashing only!
> >
> > I can point you to some articles that I wrote regarding OpenID,
> > however, let me share my thoughts quickly as that will save you some
> > time and of course if you are still curious you can go research
> > further.
> >
> > First of all, OpenID is a very simple but rather useful technology.
> > With OpenID you have only one account, your ID, which you can use
> > everywhere where the OpenID technology is supported. It is not clear
> > whether this setup is more secure from what we have at the moment
> > (every site forces you to register unique username/password pair) but
> > it is definitely more convenient. The first argument "for" OpenID is
> > that the more you share your secrets, credits card information,
> > usernames, password, the higher the chances this information to be
> > leaked or stolen. On the other hand, OpenID is prone to phishing
> > attacks so user education is required.
> >
> > Think about OpenID as the equivalent of PayPal for authentication. In
> > theory, it is more secure to pay through paypal as you are not sharing
> > your credit card information with everyone else but a single provider.
> >
> > I am all "for" OpenID as you can spend good time on securing a single
> > system. If the OpenID provider is not vulnerable to common Web attacks
> > and it provides good privacy mechanisms such as SSL and the top of
> > which are build good authentication features such as one-time tokens,
> > etc.... then OpenID is the preferable choice. Keep in mind though,
> > that if your OpenID account is hacked, the attacker will be able to
> > login as you anywhere they want. This is the main concern and
> > disadvantage.
> >
> > pdp
> >
> > P.S. dear list, the only reason I am not priv-massaging Steven is
> > because I believe that there are other people who are interested in
> > this topic. So, instead of wasting valuable resources and energy
> > answering everyone individually, I've decided to do it once hoping
> > that this message will be seen by others. Thanks!
> >
> >
> >
> >
> > On Sun, Mar 23, 2008 at 12:18 PM, Steven Rakick <stevenrakick@...oo.com>
> wrote:
> > > Hello list,
> > >
> > >  I'm curious what the group thinks about the recent
> > >  surge in support for OpenID across the web and the
> > >  impact it will have.
> > >
> > >  1) Beemba - http://www.beemba.com
> > >  2) ClaimID - http://www.claimid.com
> > >  3) MyOpenID - http://www.myopenid.com
> > >  4) Many others...
> > >
> > >  These sites are gaining in popularity quickly and with
> > >  the announcements of support from big players Yahoo,
> > >  AOL, Microsoft and Google, combined with smaller
> > >  web2.0 celeb-run sites like Digg, OpenID appears to
> > >  what will eventually be the norm.
> > >
> > >  Thoughts?
> > >
> > >  I've also noticed that many of these sites are
> > >  bundling Information Card support (CardSpace on
> > >  Windows). Sounds like a good idea as it compliments
> > >  OpenID and helps address some weaknesses.
> > >
> > >  Again, any thoughts?
> > >
> > >  I'm really just interested in a dialog.
> > >
> > >  -sr
> > >
> > >
> > >
> ____________________________________________________________________________________
> > >  Never miss a thing.  Make Yahoo your home page.
> > >  http://www.yahoo.com/r/hs
> > >
> > >  _______________________________________________
> > >  Full-Disclosure - We believe in it.
> > >  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > >  Hosted and sponsored by Secunia - http://secunia.com/
> > >
> >
> >
> >
> > --
> >
> > Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters
> >
> > gnucitizen.org | hakiri.org | spinhunters.org
> >
> >
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
>



-- 

Petko D. (pdp) Petkov | GNUCITIZEN | Hakiri | Spin Hunters

gnucitizen.org | hakiri.org | spinhunters.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists