Assurance

[Tom Scavo <>]

> The fact that Google and others have gone to the trouble of becoming
> ICAM approved is evidence that 800-63 is gaining traction as a
> standard "in the broader marketplace".

No, I don't think so. Google is simply acknowledging the fact that IdPs will 
ultimately be categorized with respect to their trustworthiness. Jumping on 
the ICAM bandwagon is perhaps the best way to distinguish yourself as an IdP, 
at least for the moment.

Note that Google could not possibly certify as InCommon Bronze since they 
don't meet the password entropy requirements. However, Google employs 
risk-based authentication measures that mitigate some of the same threats 
that password entropy addresses. AFAIK, there's nothing about risk-based 
authentication in 800-63 but apparently ICAM thinks Google's approach 
deserves LoA-1.

Tom