A selector for OpenID

[Brian Ellin-2]

Hello OpenID Folks,

Working at JanRain, the recurring stories we hear when talking with
website operators about adding relying party support is "our users
won't understand URL as an identifier", or "we're waiting until it's
easier".

Using all the feedback we've received while developing OpenID related
products,  we developed a widget that we think addresses many of the
usability issues surrounding OpenID.  We're hoping you'll take a look
and provide feedback to help us make it better.

It's a widget (https://www.openidselector.com/) that you add to the
existing OpenID login form on your relying party website.   It's all
about getting users signed into your website as quickly and
efficiently as possible, and achieves this by providing a simple,
consistent, provider neutral interface, all while educating  the user
about OpenID during the process.  It hooks into your already
functional OpenID login form, and enhances it with a little bit of
javascript.

(See attached screenshot)

The first time a user sees the widget (at your site or any other
site), it helps them choose an OpenID provider at which they may
already have an account.   If the user doesn't have an account at any
of the services listed, they simply click the "Get an OpenID" or the
"Help" links, both of which are configurable by you.   You can also
customize which OpenID providers appear in the widget and in what
order they are presented.

When a user returns to your website, or any other site that uses the
widget, their OpenID is filled in for them automatically for a "one
click" login experience.  If you choose to use different OpenIDs at
different websites, it remembers that too.

Also, it's smart and knows the capabilities of your relying party and
the OpenID providers, so that it won't lead your user down a dead end.
 For example, if your RP only supports OpenID 1.x right now, it won't
show 2.0 only providers in the list.

We pre-populated the widget with the providers from
http://openid.net/get, but any OpenID provider may be added to the
widget.  Details are here:
https://www.openidselector.com/partners

It's a beta, and we're hoping you'll give it a try and provide
feedback to help make it better!

Thanks,
Brian Ellin
JanRain, Inc.
brian@...


_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[David Recordon-2]

While generally I like it, I think your choice in domain name is  
innapropriate and not in support of the OpenID community. By choosing  
to use the domain OpenIDSelector.com you're creating the impression  
that this is *the* OpenID selector which I highly doubt you guys  
intended to do.  I did provide JanRain with this feedback directly,  
but I guess you guys disagreed. I'm so used to JanRain doing great  
things for the OpenID community that this move really surprises me.

--David

On Apr 18, 2008, at 6:46 PM, "Brian Ellin" <brian@...> wrote:

> Hello OpenID Folks,
>
> Working at JanRain, the recurring stories we hear when talking with
> website operators about adding relying party support is "our users
> won't understand URL as an identifier", or "we're waiting until it's
> easier".
>
> Using all the feedback we've received while developing OpenID related
> products,  we developed a widget that we think addresses many of the
> usability issues surrounding OpenID.  We're hoping you'll take a look
> and provide feedback to help us make it better.
>
> It's a widget (https://www.openidselector.com/) that you add to the
> existing OpenID login form on your relying party website.   It's all
> about getting users signed into your website as quickly and
> efficiently as possible, and achieves this by providing a simple,
> consistent, provider neutral interface, all while educating  the user
> about OpenID during the process.  It hooks into your already
> functional OpenID login form, and enhances it with a little bit of
> javascript.
>
> (See attached screenshot)
>
> The first time a user sees the widget (at your site or any other
> site), it helps them choose an OpenID provider at which they may
> already have an account.   If the user doesn't have an account at any
> of the services listed, they simply click the "Get an OpenID" or the
> "Help" links, both of which are configurable by you.   You can also
> customize which OpenID providers appear in the widget and in what
> order they are presented.
>
> When a user returns to your website, or any other site that uses the
> widget, their OpenID is filled in for them automatically for a "one
> click" login experience.  If you choose to use different OpenIDs at
> different websites, it remembers that too.
>
> Also, it's smart and knows the capabilities of your relying party and
> the OpenID providers, so that it won't lead your user down a dead end.
> For example, if your RP only supports OpenID 1.x right now, it won't
> show 2.0 only providers in the list.
>
> We pre-populated the widget with the providers from
> http://openid.net/get, but any OpenID provider may be added to the
> widget.  Details are here:
> https://www.openidselector.com/partners
>
> It's a beta, and we're hoping you'll give it a try and provide
> feedback to help make it better!
>
> Thanks,
> Brian Ellin
> JanRain, Inc.
> brian@...
> <selector-screenshot.png>
> <mime-attachment.txt>

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Lachlan Hardy]

It's a widget (https://www.openidselector.com/) that you add to the
existing OpenID login form on your relying party website.   It's all
about getting users signed into your website as quickly and
efficiently as possible, and achieves this by providing a simple,
consistent, provider neutral interface, all while educating  the user
about OpenID during the process.  It hooks into your already
functional OpenID login form, and enhances it with a little bit of
javascript.

Very cool, Brian! As I've just spent a week working on a very similar interface for one specific project, I'm very impressed that you've brought out a generic version. (of course, I wish I'd seen this a week ago, but that's my problem).

I'll definitely be looking at implementing it on place of what we built. Thanks!

Lachlan Hardy

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Johannes Ernst-6]

In defense of JanRain, I'd say that as the OpenID Foundation, so far  
we have given insufficient guidance on which domain names or product  
names are okay and which aren't.

In defense of the foundation, I'd say that we are only a few steps in  
the process of obtaining the trademark registrations that gives us the  
power to actually mean what we say (which is why we haven't said  
much...)

So among friends, I'd like to encourage JanRain to perhaps find  
another really cool domain name *before* lots of people use it and  
hard-code their links to it -- after all, we'd all hate having to rip  
it out once it is really adopted by many sites ... and I'm sure we all  
agree that the resources of the OpenID Foundation as well as the  
OpenID community should be spent on better things than on (avoidable)  
trademark issues.




On 2008/04/18, at 19:15, David Recordon wrote:

> While generally I like it, I think your choice in domain name is
> innapropriate and not in support of the OpenID community. By choosing
> to use the domain OpenIDSelector.com you're creating the impression
> that this is *the* OpenID selector which I highly doubt you guys
> intended to do.  I did provide JanRain with this feedback directly,
> but I guess you guys disagreed. I'm so used to JanRain doing great
> things for the OpenID community that this move really surprises me.
>
> --David
>
> On Apr 18, 2008, at 6:46 PM, "Brian Ellin" <brian@...> wrote:
>
>> Hello OpenID Folks,
>>
>> Working at JanRain, the recurring stories we hear when talking with
>> website operators about adding relying party support is "our users
>> won't understand URL as an identifier", or "we're waiting until it's
>> easier".
>>
>> Using all the feedback we've received while developing OpenID related
>> products,  we developed a widget that we think addresses many of the
>> usability issues surrounding OpenID.  We're hoping you'll take a look
>> and provide feedback to help us make it better.
>>
>> It's a widget (https://www.openidselector.com/) that you add to the
>> existing OpenID login form on your relying party website.   It's all
>> about getting users signed into your website as quickly and
>> efficiently as possible, and achieves this by providing a simple,
>> consistent, provider neutral interface, all while educating  the user
>> about OpenID during the process.  It hooks into your already
>> functional OpenID login form, and enhances it with a little bit of
>> javascript.
>>
>> (See attached screenshot)
>>
>> The first time a user sees the widget (at your site or any other
>> site), it helps them choose an OpenID provider at which they may
>> already have an account.   If the user doesn't have an account at any
>> of the services listed, they simply click the "Get an OpenID" or the
>> "Help" links, both of which are configurable by you.   You can also
>> customize which OpenID providers appear in the widget and in what
>> order they are presented.
>>
>> When a user returns to your website, or any other site that uses the
>> widget, their OpenID is filled in for them automatically for a "one
>> click" login experience.  If you choose to use different OpenIDs at
>> different websites, it remembers that too.
>>
>> Also, it's smart and knows the capabilities of your relying party and
>> the OpenID providers, so that it won't lead your user down a dead  
>> end.
>> For example, if your RP only supports OpenID 1.x right now, it won't
>> show 2.0 only providers in the list.
>>
>> We pre-populated the widget with the providers from
>> http://openid.net/get, but any OpenID provider may be added to the
>> widget.  Details are here:
>> https://www.openidselector.com/partners
>>
>> It's a beta, and we're hoping you'll give it a try and provide
>> feedback to help make it better!
>>
>> Thanks,
>> Brian Ellin
>> JanRain, Inc.
>> brian@...
>> <selector-screenshot.png>
>> <mime-attachment.txt>
>
> _______________________________________________
> general mailing list
> general@...
> http://openid.net/mailman/listinfo/general

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Eddy Nigg (StartCom Ltd.)]

David, why's that?

There are various domains with the word openid in it, starting from openidenabled, openiddirectory and now openidselector....Don't see anything wrong with that...

This looks like some first effort to federate....not bad at all!

David Recordon:

While generally I like it, I think your choice in domain name is  
innapropriate and not in support of the OpenID community. By choosing  
to use the domain OpenIDSelector.com you're creating the impression  
that this is *the* OpenID selector which I highly doubt you guys  
intended to do.  I did provide JanRain with this feedback directly,  
but I guess you guys disagreed. I'm so used to JanRain doing great  
things for the OpenID community that this move really surprises me.

--David

On Apr 18, 2008, at 6:46 PM, "Brian Ellin" brian@... wrote:

  

Hello OpenID Folks,

Working at JanRain, the recurring stories we hear when talking with
website operators about adding relying party support is "our users
won't understand URL as an identifier", or "we're waiting until it's
easier".

Using all the feedback we've received while developing OpenID related
products,  we developed a widget that we think addresses many of the
usability issues surrounding OpenID.  We're hoping you'll take a look
and provide feedback to help us make it better.

It's a widget (https://www.openidselector.com/) that you add to the
existing OpenID login form on your relying party website.   It's all
about getting users signed into your website as quickly and
efficiently as possible, and achieves this by providing a simple,
consistent, provider neutral interface, all while educating  the user
about OpenID during the process.  It hooks into your already
functional OpenID login form, and enhances it with a little bit of
javascript.

(See attached screenshot)

The first time a user sees the widget (at your site or any other
site), it helps them choose an OpenID provider at which they may
already have an account.   If the user doesn't have an account at any
of the services listed, they simply click the "Get an OpenID" or the
"Help" links, both of which are configurable by you.   You can also
customize which OpenID providers appear in the widget and in what
order they are presented.

When a user returns to your website, or any other site that uses the
widget, their OpenID is filled in for them automatically for a "one
click" login experience.  If you choose to use different OpenIDs at
different websites, it remembers that too.

Also, it's smart and knows the capabilities of your relying party and
the OpenID providers, so that it won't lead your user down a dead end.
For example, if your RP only supports OpenID 1.x right now, it won't
show 2.0 only providers in the list.

We pre-populated the widget with the providers from
http://openid.net/get, but any OpenID provider may be added to the
widget.  Details are here:
https://www.openidselector.com/partners

It's a beta, and we're hoping you'll give it a try and provide
feedback to help make it better!

Thanks,
Brian Ellin
JanRain, Inc.
brian@...
<selector-screenshot.png>
<mime-attachment.txt>
    

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general
  

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Peter Williams-15]

Fascinating! Not the widget itself, but the economics of the strategy of dis-intermediating the IDPs. If it takes off, you can see the model as one of: rewarding IDP adoption and delivery of related service by increasing brand logo presence This will do wonders for JanRain's valuation in the eyes of the dominant OPs/IDPs.

 

This is exactly the dynamics that intelligent directory-based infrastructure needs to take off, rather than be a stuffy telco-white pages implementation, a layer 7 service resolver, or layer 3 net address resolver. Outsourcing id is one model, but its not half as explosive a curve as certs were, as openid  will be (certs financed two new billionares, and one trip to the space station by a tourist: openid CAN do better!)  Lets recall the old war horse story: pure directories (and files like FOAF) tend to always get stuck at the fact that business are dis-incentivised from every publicising their people power; this they dont, even if you (finally) add the security model. Here we have directories moderating a brand market, which is excellent.

 

Now, we need 10 of these (sounds like we have 2 already) : and a slew of economic/revenue models in which brands can also use indirect $$ or indirect payback or to bias the dis-intermediator to alter the display. Then we need consume rejection, and all the usual arguments that will make the marketing space vibrant -- and (nicely) political. The factors that come into play will be nefarious, just like all the places re-factoring impacts service economies.

 

_________________________
Peter Williams

---

From: Lachlan Hardy
Sent: Fri 4/18/2008 8:10 PM
To: Brian Ellin
Cc: general@...
Subject: Re: [OpenID] A selector for OpenID

It's a widget (https://www.openidselector.com/) that you add to the
existing OpenID login form on your relying party website.   It's all
about getting users signed into your website as quickly and
efficiently as possible, and achieves this by providing a simple,
consistent, provider neutral interface, all while educating  the user
about OpenID during the process.  It hooks into your already
functional OpenID login form, and enhances it with a little bit of
javascript.

Very cool, Brian! As I've just spent a week working on a very similar interface for one specific project, I'm very impressed that you've brought out a generic version. (of course, I wish I'd seen this a week ago, but that's my problem).

I'll definitely be looking at implementing it on place of what we built. Thanks!

Lachlan Hardy

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Eddy Nigg (StartCom Ltd.)]

Johannes Ernst:

In defense of JanRain, I'd say that as the OpenID Foundation, so far  
we have given insufficient guidance on which domain names or product  
names are okay and which aren't.

In defense of the foundation, I'd say that we are only a few steps in  
the process of obtaining the trademark registrations that gives us the  
power to actually mean what we say (which is why we haven't said  
much...)

So among friends, I'd like to encourage JanRain to perhaps find  
another really cool domain name *before* lots of people use it and  
hard-code their links to it -- after all, we'd all hate having to rip  
it out once it is really adopted by many sites ... and I'm sure we all  
agree that the resources of the OpenID Foundation as well as the  
OpenID community should be spent on better things than on (avoidable)  
trademark issues.

  

Not sure if you can enforce that. As long as it doesn't say only "OpenID" I belive it's not enforceable at all. Then what about spreadopenid.org, myopenid.com, openid.org, openid.yahoo.com, openidenabled.com, openiddirectory.com, openid.sun.com, openid.cn, openidfrance.fr, openid.pl, openid.trustbearer.com, openidsource.org

BTW, http://openid.net/ shows a logo with content OpenID.net and no trademark symbols at all ® or ™....this is not enforcing trademarks at all!!


_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Peter Watkins-2]

On Sat, Apr 19, 2008 at 01:10:46PM +1000, Lachlan Hardy wrote:
> Very cool, Brian! As I've just spent a week working on a very similar
> interface for one specific project, I'm very impressed that you've brought
> out a generic version. (of course, I wish I'd seen this a week ago, but
> that's my problem).

I've been thinking that something like this was needed, too, though I
had not gotten as far as any coding. We're about to launch some login-
required apps at work, and I like the idea of letting users reuse their
existing accounts -- AOL and Yahoo! are probably quite prevalent (it's
a shame there are no official Gmail and Passport/Hotmail OPs), but I
don't expect users to understand OpenID URLs.

I haven't looked at the guts, but I'd ask that this be designed &
licensed to allow me to install the JS, images, etc. on my own server
-- both to eliminate a point of failure and for privacy reasons. As a
matter of security policy, I don't allow embedding any Javascript that
I don't control on my login, logout, and other account management pages,
and I try hard not to reference even images on other servers (privacy reasons).

On a purely aesthetic point, I'd suggest adding another "Sign in" link
in the provider pick list drop down for those providers that require
a specific identity, e.g. add a Sign in link next to the screenname
input when the user chooses AOL/AIM.

And the Help link should display more help on the same page as the selector.

But this is really quite nice!

-Peter

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Max Metral]

Yeah, I really agree with Peter here.  There is nothing inherent in the
tool that requires an "app key" or any sort of locking into Janrain.  I
don't begrudge them the attempt or desire to build a large "addressable"
installed widget base, and in fact for most people it will be just fine.
For me, I would only use it if I could have all the resources served
locally, or at worst some img tag with a "delayed" javascript load.  So
I think that basically puts the question to Brian and Janrain of "Was
your primary goal to build widget installs or to help OpenId?  If the
latter, would you just give out the code, perhaps with a branding and
link requirement but w/o resource hosting?"

I would be totally fine with "widget installs" and "no," but it'd
probably make me wait for another implementation.

--Max

-----Original Message-----
From: general-bounces@... [mailto:general-bounces@...] On
Behalf Of Peter Watkins
Sent: Saturday, April 19, 2008 7:45 AM
To: Lachlan Hardy
Cc: general@...
Subject: Re: [OpenID] A selector for OpenID

On Sat, Apr 19, 2008 at 01:10:46PM +1000, Lachlan Hardy wrote:
> Very cool, Brian! As I've just spent a week working on a very similar
> interface for one specific project, I'm very impressed that you've
brought
> out a generic version. (of course, I wish I'd seen this a week ago,
but
> that's my problem).

I've been thinking that something like this was needed, too, though I
had not gotten as far as any coding. We're about to launch some login-
required apps at work, and I like the idea of letting users reuse their
existing accounts -- AOL and Yahoo! are probably quite prevalent (it's
a shame there are no official Gmail and Passport/Hotmail OPs), but I
don't expect users to understand OpenID URLs.

I haven't looked at the guts, but I'd ask that this be designed &
licensed to allow me to install the JS, images, etc. on my own server
-- both to eliminate a point of failure and for privacy reasons. As a
matter of security policy, I don't allow embedding any Javascript that
I don't control on my login, logout, and other account management pages,
and I try hard not to reference even images on other servers (privacy
reasons).

On a purely aesthetic point, I'd suggest adding another "Sign in" link
in the provider pick list drop down for those providers that require
a specific identity, e.g. add a Sign in link next to the screenname
input when the user chooses AOL/AIM.

And the Help link should display more help on the same page as the
selector.

But this is really quite nice!

-Peter

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Dick Hardt]

On 19-Apr-08, at 4:05 AM, Eddy Nigg (StartCom Ltd.) wrote:

Johannes Ernst:

In defense of JanRain, I'd say that as the OpenID Foundation, so far  
we have given insufficient guidance on which domain names or product  
names are okay and which aren't.

In defense of the foundation, I'd say that we are only a few steps in  
the process of obtaining the trademark registrations that gives us the  
power to actually mean what we say (which is why we haven't said  
much...)

So among friends, I'd like to encourage JanRain to perhaps find  
another really cool domain name *before* lots of people use it and  
hard-code their links to it -- after all, we'd all hate having to rip  
it out once it is really adopted by many sites ... and I'm sure we all  
agree that the resources of the OpenID Foundation as well as the  
OpenID community should be spent on better things than on (avoidable)  
trademark issues.

  

Not sure if you can enforce that. As long as it doesn't say only "OpenID" I belive it's not enforceable at all. Then what about spreadopenid.org, myopenid.com, openid.org, openid.yahoo.com, openidenabled.com, openiddirectory.com, openid.sun.com, openid.cn, openidfrance.fr, openid.pl, openid.trustbearer.com, openidsource.org

the .org and .com domains are enforcable under US law and then using the Uniform Domain-Dispute Dispute-Resolution Policy

http://www.icann.org/udrp/udrp.htm

.fr, .pl, .cn are another story

BTW, http://openid.net/ shows a logo with content OpenID.net and no trademark symbols at all ® or ™....this is not enforcing trademarks at all!!

a trademark does not need to have those symbols beside it to be enforceable

on behalf of the foundation, I would echo Johannes diplomatic request

-- Dick

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Eddy Nigg (StartCom Ltd.)]

Dick Hardt:

Not sure if you can enforce that. As long as it doesn't say only "OpenID" I belive it's not enforceable at all. Then what about spreadopenid.org, myopenid.com, openid.org, openid.yahoo.com, openidenabled.com, openiddirectory.com, openid.sun.com, openid.cn, openidfrance.fr, openid.pl, openid.trustbearer.com, openidsource.org

the .org and .com domains are enforcable under US law and then using the Uniform Domain-Dispute Dispute-Resolution Policy

http://www.icann.org/udrp/udrp.htm

.fr, .pl, .cn are another story

Yup...and all the others as well...including openidselector.com I guess...
...and then it depends even how, where, what registered when...

BTW, http://openid.net/ shows a logo with content OpenID.net and no trademark symbols at all ® or ™....this is not enforcing trademarks at all!!

a trademark does not need to have those symbols beside it to be enforceable

Right, but as  a first steps you should make others aware of your claim and/or trademark registration. Without failing to do so, you might have a much harder time in court + paying expenses as well...I'd suggest to get advice from a lawyer specialized in trademark issues.

BTW, I was looking for trademark symbols and couldn't find any, even so I knew that there was some discussions about it.

on behalf of the foundation, I would echo Johannes diplomatic request

Which is noble indeed :-)


_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Dick Hardt]

On 19-Apr-08, at 8:13 AM, Eddy Nigg (StartCom Ltd.) wrote:

Dick Hardt:

Not sure if you can enforce that. As long as it doesn't say only "OpenID" I belive it's not enforceable at all. Then what about spreadopenid.org, myopenid.com, openid.org, openid.yahoo.com, openidenabled.com, openiddirectory.com, openid.sun.com, openid.cn, openidfrance.fr, openid.pl, openid.trustbearer.com, openidsource.org

the .org and .com domains are enforcable under US law and then using the Uniform Domain-Dispute Dispute-Resolution Policy

http://www.icann.org/udrp/udrp.htm

.fr, .pl, .cn are another story

Yup...and all the others as well...including openidselector.com I guess...
...and then it depends even how, where, what registered when...

Not sure what you are meaning Eddy.

If the trademark is in the domain name, then it using the mark.

How Mozilla protects the Firefox mark is a good example for the OpenID community. The OpenID Foundation REALLY, REALLY needs to develop a policy soon so that people know how to use the mark!

Note they don't have (tm) around Firefox, and don't need to. (tm) indicates to someone that it is likely a trademark, but is not required. 

-- Dick

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[SitG Admin]

>we developed a widget that we think addresses many of the
>usability issues surrounding OpenID.  We're hoping you'll take a look
>and provide feedback to help us make it better.

First thoughts:

Can we modify the source code at all? For instance, put another
separator or two in there for "myOpenID ClaimID Clickpass Vidoop"
(another modification: could we extend the width to 4 entries per row
to accomodate that?) and identify them as "2nd-class citizens", plus
another separator for any links to tutorials on becoming their own OP?

How does it maintain state? Will your site be communicating with (and
effectively tracking) users to provide it?

-Shade
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Brian Ellin-2]

Thanks for the feedback on the name.  Just wanted to let everyone know
that we'll be changing it from openidselector.com to idselector.com so
as not to infringe on the OpenID mark.

This change will be made over the next few days.  Stay tuned for an update.

Brian

> on behalf of the foundation, I would echo Johannes diplomatic request
>
> -- Dick
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Eddy Nigg (StartCom Ltd.)]

Dick Hardt:

Yup...and all the others as well...including openidselector.com I guess...
...and then it depends even how, where, what registered when...

Not sure what you are meaning Eddy.

First of all, OpenID is a standard for authentication and as such I'm not sure how trademarks are and can be applied and to which extend. It's not a product! As I said before, if you haven't done so already, you should consult with a specialist in this field.

A good example for separation of such possible trademark issues might be Jabber and its XMPP standard (was previously Jabber as well).

If the trademark is in the domain name, then it using the mark.

Again, I'm not sure to which extend this can be enforced and you might be on the loosing end in many cases. Because somebody has a domain with the word windows in it, it doesn't mean he is infringing the trademarks of Microsoft. Nor can it be applied in every country...

How Mozilla protects the Firefox mark is a good example for the OpenID community.

Yes, and OpenID is most likely not even close to Mozilla's enforcements....However I know more about what Mozilla does in this respect than about OpenID

The OpenID Foundation REALLY, REALLY needs to develop a policy soon so that people know how to use the mark!

Indeed...

Note they don't have (tm) around Firefox, and don't need to.

Yes they do. Since it's a registered trademark in the US it has the ® symbol next to the logo: http://www.mozilla.com/en-US/

(tm) indicates to someone that it is likely a trademark, but is not required.

Which can be brought against you to a certain extend...again, get advice from somebody who knows about it, but of course you can disregard my advice... :-)



_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Peter Williams-15]

Oh well, its now hopefully an irrelevant topic for now. JanRain just made an obvious community-spirited effort by not enabling anyone to argue (much further) over their choice of name for a fascinating new feature! Hopefully, we can focus on the feature itself!

 

In my  view JanRain are possibly hearing and properly reacting what we hear back from our pilot groups: the average business user will not adopt the default OpenID GUI while users have to type in a damn URL, several times a day. The cost of Sxipper to have their FF plugin post the form field is (im guessing) 2 months service revenue (in our market), and would cost $15-20 per user in support/installation cost for the bottom 25% of the user community. That's pretty prohibitive adoption economics (in our market). In terms of JanRain's adwords-like dynamic applied to OpenID, that is just a smart move.

 

I think we need a buzzword name for this "adword" practice, and a framework for warning: the concept is very similar in essence to an (abandoned) RFP tender issued last year in realty to let the presentation order of SSO links be "paid for", as indirect advertising/brand-promotion of the many home conveyancing/closing services seeking out clients in a trillion dollar business. The problem is that its preceived as influencing the very realtors, who inevitably recommend services to homeowners (did you choose your own title company!!? Last time) . Unfortunately its also their job to be a trusworthy counsel to homeowners... creating and ethical council conflict, which needed to address the conflicting issues of trust and impropriety - in a professional space)

 

-----------

 

Lets turn to what we learned about trandemarks specifically tho, and test what happens.

 

I suppose I ought to now expect the Foundation's legal notice, concerning "my" UN-authorized use of openid2.blogspot.com (setup to see what blogspot did and did not do, re OpenID1 and OpenID2  support). Presumably, the paralegal's nastygram would actually go to Google, who will surely dump me as a subscriber faster than a photon moves.

 

If I now think as a security specialist and focus on the compromise recovery phase use cases, I suppose that the impact of such an account suspension/removal for the blog -  on my UCI delegation setup - would be 100% up to me to fight out with this and any other trademark owner who merely _asserts_ infringement. Any commercial entity like a Live.com, Google or Yahoo will act on it regardless of little ol #me; and notice time will be zero, I have little doubt, to minimize risk to the operator. Generally, fightingthe notice will takes time, in the meatime one needs to ensure there can be little impact. Obviously, one needs to ensure there _is_ a real, per-notice cost to the asserting/servicing party, as a dis-incentive against wide area abuse.

 

At first glance, it looks like OpenID and the reliance on redundant discovery got things right tho - as a critical infrastructure design with compomise recovery capabilities. The design seems to ensure that its cheap and easy to have several delegation points setup with redundant security contexts - and pre-keyed session caches at the supporting OPs. These can be pushed into service and pre-made for folks, ready for such events (new startup business model!!?).  Such preparations do not withstand generalized legal shutdown/take-down orders (and they are not meant to). In taking such precautions, one is simply being a responsible UCI-comprehending consumer, preparing to cope with impact on #your OPenID discovery that the inevitable self-interest of those commercial parties providing ad-funded "free blog services" would have. In business this would be an issue of intangible goodwill asset, with accountable value and risk - since your contractors parties can now influence those via their impact on #your connectivity and #your responsiveness properties #your OpenID reputation, in the openid trust model.

 

_________________________
Peter Williams

---

From: Brian Ellin
Sent: Sat 4/19/2008 10:33 AM
To: Dick Hardt; drecordon@...; Johannes Ernst
Cc: openid-general List
Subject: Re: [OpenID] A selector for OpenID

Thanks for the feedback on the name.  Just wanted to let everyone know
that we'll be changing it from openidselector.com to idselector.com so
as not to infringe on the OpenID mark.

This change will be made over the next few days.  Stay tuned for an update.

Brian

> on behalf of the foundation, I would echo Johannes diplomatic request
>
> -- Dick
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[SitG Admin]

>>we developed a widget that we think addresses many of the
>>usability issues surrounding OpenID.  We're hoping you'll take a look
>>and provide feedback to help us make it better.

Second thoughts:

>How does it maintain state? Will your site be communicating with (and
>effectively tracking) users to provide it?

Could it be decentralized further (in the pursuit of privacy) to
enable sites using this widget to communicate with you to establish
the initial state? For example, first my site checks with the user to
see if they've been here before; *then*, if not, it asks your site
"Who is this?". Maybe a couple of different cookies (but I assume
here, that this is how you're keeping track of state), one just for
you (holding whatever you need it to) and one that can be shared with
anyone using the widget?

-Shade
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[Snorri]

+1,
Thanks very much for your understanding

-Snorri

-----Message d'origine-----
De : general-bounces@... [mailto:general-bounces@...] De la
part de Brian Ellin
Envoyé : samedi 19 avril 2008 19:33
À : Dick Hardt; drecordon@...; Johannes Ernst
Cc : openid-general List
Objet : Re: [OpenID] A selector for OpenID

Thanks for the feedback on the name.  Just wanted to let everyone know
that we'll be changing it from openidselector.com to idselector.com so
as not to infringe on the OpenID mark.

This change will be made over the next few days.  Stay tuned for an update.

Brian

> on behalf of the foundation, I would echo Johannes diplomatic request
>
> -- Dick
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general


_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[larry drebes]

Certainly an RP could store it's own cookie, and check that before it loads it's javascript.  larry-

On Sat, Apr 19, 2008 at 3:38 PM, SitG Admin <sysadmin@...> wrote:

>>we developed a widget that we think addresses many of the
>>usability issues surrounding OpenID.  We're hoping you'll take a look
>>and provide feedback to help us make it better.

Second thoughts:

>How does it maintain state? Will your site be communicating with (and
>effectively tracking) users to provide it?

Could it be decentralized further (in the pursuit of privacy) to
enable sites using this widget to communicate with you to establish
the initial state? For example, first my site checks with the user to
see if they've been here before; *then*, if not, it asks your site
"Who is this?". Maybe a couple of different cookies (but I assume
here, that this is how you're keeping track of state), one just for
you (holding whatever you need it to) and one that can be shared with
anyone using the widget?

-Shade
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

[larry drebes]

Max,
The primary goal is to make is to improve the end-user experience for OpenID.  There is a large user education problem that is throttling OpenID growth.  We were also trying to make it simple for the RP, and neutral for the OPs.

The javascript attaches to an existing OpenID login form.  In the (rare) case the javascript could not load from the (high available) idselector server, the form will continue to work, just with out a default value.

larry-

On Sat, Apr 19, 2008 at 7:29 AM, Max Metral <max@...> wrote:

Yeah, I really agree with Peter here.  There is nothing inherent in the
tool that requires an "app key" or any sort of locking into Janrain.  I
don't begrudge them the attempt or desire to build a large "addressable"
installed widget base, and in fact for most people it will be just fine.
For me, I would only use it if I could have all the resources served
locally, or at worst some img tag with a "delayed" javascript load.  So
I think that basically puts the question to Brian and Janrain of "Was
your primary goal to build widget installs or to help OpenId?  If the
latter, would you just give out the code, perhaps with a branding and
link requirement but w/o resource hosting?"

I would be totally fine with "widget installs" and "no," but it'd
probably make me wait for another implementation.

--Max

-----Original Message-----
From: general-bounces@... [mailto:general-bounces@...] On
Behalf Of Peter Watkins
Sent: Saturday, April 19, 2008 7:45 AM
To: Lachlan Hardy
Cc: general@...
Subject: Re: [OpenID] A selector for OpenID

On Sat, Apr 19, 2008 at 01:10:46PM +1000, Lachlan Hardy wrote:
> Very cool, Brian! As I've just spent a week working on a very similar
> interface for one specific project, I'm very impressed that you've
brought
> out a generic version. (of course, I wish I'd seen this a week ago,
but
> that's my problem).

I've been thinking that something like this was needed, too, though I
had not gotten as far as any coding. We're about to launch some login-
required apps at work, and I like the idea of letting users reuse their
existing accounts -- AOL and Yahoo! are probably quite prevalent (it's
a shame there are no official Gmail and Passport/Hotmail OPs), but I
don't expect users to understand OpenID URLs.

I haven't looked at the guts, but I'd ask that this be designed &
licensed to allow me to install the JS, images, etc. on my own server
-- both to eliminate a point of failure and for privacy reasons. As a
matter of security policy, I don't allow embedding any Javascript that
I don't control on my login, logout, and other account management pages,
and I try hard not to reference even images on other servers (privacy
reasons).

On a purely aesthetic point, I'd suggest adding another "Sign in" link
in the provider pick list drop down for those providers that require
a specific identity, e.g. add a Sign in link next to the screenname
input when the user chooses AOL/AIM.

And the Help link should display more help on the same page as the
selector.

But this is really quite nice!

-Peter

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general
_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general

_______________________________________________
general mailing list
general@...
http://openid.net/mailman/listinfo/general