Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...