[sldev] OpenID & SSL certificates

[Dzonatas]

Argent Stonecutter wrote:
> On 30-Sep-2007, at 10:54, Dzonatas wrote:
>>> Does this require my using the same identity with SL as with other 
>>> OpenID services?
>
>> I'm not sure by "other" you mean affiliated or non-affiliated OpenID 
>> servers.
>
> By "other" I mean "any company other than Linden Labs".

Ok. That doesn't change my answer.


>
>>> Can the authentication be handled entirely within SL?
>
>> Since SL can be partially in-world and part web, as it now exists, yes.
>
> By "handled" I mean "the entire process, including creating the 
> certificate".
>
> By "entirely within SL" I mean both "with no other application 
> involved, including a web browser", and "without any company other 
> than Linden Labs being involved".
>
> Otherwise, if it comes to OpenID or something like LL's original 
> proposal *except* with a client that handled the login entirely within 
> the application, using web services (or a hardcoded form response) 
> over HTTPS, I would prefer the latter.

That would all depend on final implementation. It is possible either 
way. Keep in mind that an authoritative (3rd) party needs to sign more 
permanent and secure certificates, but certificates can still be made on 
a standalone basis.

The question really to ask is:

Being that this is a new proposal and that OpenID already exists, can we 
make LL's proposal better than OpenID? Or, should we just resolve to OpenID?

Given the option of SSL certificates, I believe OpenID or LL's proposal 
both also become optional.


-- 
Power to Change the Void