<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>I should probably strengthen this language. Specifically, user authentication is often done via password. In this case, you're not just concerned with an attacker being able to take over a bearer token or a session; it's something more persistent and
less tied to an instance, and it can generally be played by the attacker to the IdP at any time.</div>
<br>
<div>
<div>On Mar 26, 2013, at 21:07 , Nate Klingenstein wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">Similarly,
I would recommend that the IdP listen only over TLS. If your metadata reflects this, then users should never be showing up at your IdP on port 80 anyway. Whether or not to redirect users that arrive on port 80 for some reason to 443 is up to your discretion.</span></blockquote>
</div>
<br>
</body>
</html>