Insecure OPs easily bring problems to consumers trusting them.
I think that there should be a kind of world wide reliability evaluation system for OPs.
Suppose every OPs has its score on the list of OPs and they should make an effort to keep its score high.
RPs are able to exploit it to know which OP is trustworthy.

But obviously, the list is centralized.
This is the SPoF and is a quite big drawback.
It should be kept decentralized as well as OpenID itself.

These days, I have been thinking about OpenID.
It is able to gather privacy informations at one place and they would be maintained easily.
On the other hand, thus it may become easy to cause a security crisis.

In order to find the solution, I have thought for a while.
I think that the secret sharing scheme (SSS) could be useful for solving this problem.
In other words, it could be reasonable way for achieving convenience and security to share the encrypted privacy informations between several OIPs by using SSS.

But I have no idea to make it run on the current OpenID spec. Hmm.

JavaScriptレベルでSafeな実行環境(Sandbox)を作る方法について、 調べたものをメモ。 [**自由にアクセス制御可能なJavaScriptサンドボックスを作る**](http://blog.tkmr.org/tatsuya/show/407-javascript)

自サイト上でユーザにJavaScriptを（限定的に）許可したい
例えば、はてなダイアリー等でユーザがブログパーツを張れるよう許可するとか。但し

• document.cookie等、危険な機能は操作不能にする
• あくまでサイト上でJSを許可する（iframeは不可）

やはり動機に関してはこのへんですね。 [**[Facebook] FBJSでFacebookアプリ内でJavaScriptを利用**](http://kawa.at.webry.info/200708/article_3.html) >Facebook では、FBML という HTML サブセットの独自言語でサードパーティの開発者が誰でもアプリケーションを作成できる。FBML では当初は