Re: [dix] Re: [Ietf-http-auth] New draft on anti-phishing requirements

[Eric Rescorla <ekr at networkresonance.com>]

Chris Drake  <christopher at pobox.com> writes:

>>>>>> "Eric" == Eric Rescorla <ekr at networkresonance.com> writes:
>
>     >>  I don't believe that my requirements would require that the
>     >> relying party talk to the identity provider.
>
> How do you propose to protect my privacy in this scenario?  I do not
> want the same credentials of mine revealed when I log in to
> "shame-your-boss.com" as when I log in to my sourceforge account, but
> I would like to avoid having to remember multitudes of different
> usernames and passwords for every web site I visit, as well as enjoy
> phishing defences... 

And you'd prefer to have your identity provider have a record
of every site you've visited?

-Ekr

_______________________________________________
dix mailing list
dix at ietf.org
https://www1.ietf.org/mailman/listinfo/dix