Re: OpenID

[Davi Leal]

> Proposed roadmap:
>
>   1. Follow adding improvements.
>
>   2. Finish the development of the volunteers and pledges feature.

...



>   5. Analyze the OpenID idea.
>      It was task: http://savannah.nongnu.org/task/?6782

I propose the project do not use any OpenID shared identity services. If 
nobody disagree we should close such task adding a reference to the below 
rationale:


Rationale:

  * If GNU Herds add OpenID support, any security problem at the OpenID
    servers will be a very serious security problem for GNU Herds.

  * What OpenID servers GNU Herds would support?  The more OpenID
    servers GNU Herds support the more security risk paths for the
    GNU Herds project.

    Note the OpenID use delegates the authentication process which is
    a central security piece.


IMHO the above rationale is enough to reject the OpenID use. Additionally:

  * Note maybe the GNU Heds project will make bank transactions. So
    the above problems are even more critic.


It could be other problems not analyzed here.

--
As usual we could be wrong. Please let this mailing list know about any 
mistake in the above rationale.