The Most Secure Implementation of OpenID

Question

What is the most secure implementation of OpenID technology?

Is there someone out there who knows enough about security, cryptography and OpenID specifications? No rumors, just facts.

I would like to know all about insecurities of network communication process between OpenID provider and OpenID-enabled site during:

• logging in
• is user logged?
• user's sensitive information interchange
• logout

and what should we be aware of.

Answer 1

Yeah, SAML is good. It has strong encryption between two endpoints. SAML 2.0 has a good binding protocol for messaging through HTTP or SOAP. It also covers identity assertions, so you can better authenticate that the user is who they say they are.

Answer 2

We use SAML.