My idea is ...

← Ideas

Encourage OpenID supported websites to have SSL option

Alot of websites that support OpenID do not use SSL (https://), instead they only have the unsecured http://. My idea is, work with the existing and also new OpenID supported websites and encourage them to setup an https:// version of their website. For example, facebook's url could be https://www.facebook.com. The websites don't have to use https as their default url because SSL is a bit slower. But by having an SSL option it will mean OpenID users will have their info encrypted and it lowers the security risks with OpenID.

310 votes
Vote

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
You have left! (?) (thinking…)
anonymous shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →
under review  ·  AdminChris Messina (Admin, OpenID) responded  · 

That’s a great idea. It’s certainly something that OPs and RPs should take into consideration.

There is currently some conversations going on about an OpenID Security Best Practices document; while the spec shouldn’t mandate SSL, it certainly should present the case for supporting it, ideally in a best practices doc.

111 comments

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
← Previous 1 3 4 5 6

Ideas

Categories

Feedback and Knowledge Base

(thinking…)