thing

Current License: CC BY-SA 3.0

10 events

when toggle format	what		by	license	comment
May 20, 2011 at 11:24	comment	added	Rakkhi		@Iszi I would propose treating those higher sensitive sites as in the highest risk bucket, thus where a user registers to use careers.so and others deemed more sensitive (e.g. storing more personal data) then require the stronger password policy and offer 2FA
May 20, 2011 at 11:23	comment	added	Rakkhi		@kevin-montrose I was only talking about having stronger policies for the Moderator role which SE will know about, not different policies for other sites using the SE Open-ID. That's why the suggestion to use number linked as a proxy for increased risk rather than asking them to provide roles. Agreed that is upto the individual site rather than SE to manager
May 20, 2011 at 11:20	history	edited	Rakkhi	CC BY-SA 3.0	updated to add sensitive SO sites
May 19, 2011 at 4:49	comment	added	Iszi		@Rakkhi - Thank you for acknowledging the question of SE OpenID usage on other sites. Can you please also address the other point I've raised, of the specific case where SEI is both the OpenID provider and the provider of an online service with higher information sensitivity such as careers.SO?
May 18, 2011 at 17:11	comment	added	Kyle Cronin		You could always just include something about double-checking the security of your OpenID provider and password in the agreement that moderators agree to before they can start moderating. Being a moderator means that there's already a great deal of trust in you, I think that we can reasonably expect moderators to take their passwords seriously.
May 18, 2011 at 16:33	comment	added	Kevin Montrose		Increasing password requirements with changing roles or authorizations is unworkable. We can't trust affiliates to notify us w.r.t. "more privileges granted to {account}" (I'm opposed to treating Stack Exchange specially in the provider, so we can't trust ourselves even). That's assuming the sites involved are even properly registered as affiliates, and not just random OpenID relying parties.
May 18, 2011 at 16:02	comment	added	Rakkhi		Internally within SE know the authorization role though. For Federated I agree, that's why I suggested count number
May 18, 2011 at 15:08	comment	added	Sklivvz		Note that the role of the users is completely delegated in open id. You only offer an authentication service, not an authorization service. In practice, you are never able to know if the user is "standard", "moderator"...)
May 18, 2011 at 14:23	history	edited	Rakkhi	CC BY-SA 3.0	Typo
May 18, 2011 at 14:18	history	answered	Rakkhi	CC BY-SA 3.0