Nabble - OpenID

Re: IPR Update passed

2009-12-15T14:53:26Z

Thanks Darin! I was pretty sure I had voted and I only use the one OpenID...as that's the point really, isn't it!?!

On Dec 15, 2009, at 2:20 PM, Darin Richardson wrote:

It is a UI issue -- the votes for you and Nate (and many others) are in there but aren't appearing on the 'you voted' page. I'll look around and get it ironed out this week.

---
Darin Richardson
Refresh Media
-
http://refreshmedia.com
503-703-3558

On Dec 15, 2009, at 2:10 PM, Chris Messina wrote:

Did you sign in with the same identifier that you voted under? I presume so... but it's worth asking.

Actually, looking at my page, I don't see that my vote is listed either... maybe it's just a UI issue?

Chris

On Tue, Dec 15, 2009 at 1:50 PM, Nate Angell <nate@...> wrote:

Glad to see it passed!

Oddly, although I voted on the IPR poll, when I log into the membership area it says I have never voted for anything. That makes me wonder if my vote was counted (though if it wasn't, it would not have changed the outcome as I voted to accept the IPR changes) or if whatever mechanism reports on votes is broken.

On Dec 15, 2009, at 10:38 AM, Chris Messina wrote:

w00t!

Will there be a final tally and blog post put out about this (I believe there should be!)?

In the meantime, members can view the results here:

https://openid.net/foundation/members/polls/21

Non-members can view the results here:

http://www.flickr.com/photos/factoryjoe/4187611971/

Chris

On Tue, Dec 15, 2009 at 10:33 AM, Don Thibeau <don@...> wrote:
Please be advised the IPR poll has closed and the vote to update the OpenID IPR process has passed.
Thanks to all who voted
Don Thibeau
_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

From forum: OpenID - General

Re: IPR Update passed

2009-12-15T14:10:36Z

Did you sign in with the same identifier that you voted under? I presume so... but it's worth asking.

Actually, looking at my page, I don't see that my vote is listed either... maybe it's just a UI issue?

Chris

On Tue, Dec 15, 2009 at 1:50 PM, Nate Angell <nate@...> wrote:

Glad to see it passed!

Oddly, although I voted on the IPR poll, when I log into the membership area it says I have never voted for anything. That makes me wonder if my vote was counted (though if it wasn't, it would not have changed the outcome as I voted to accept the IPR changes) or if whatever mechanism reports on votes is broken.

On Dec 15, 2009, at 10:38 AM, Chris Messina wrote:

w00t!

Will there be a final tally and blog post put out about this (I believe there should be!)?

In the meantime, members can view the results here:

https://openid.net/foundation/members/polls/21

Non-members can view the results here:

http://www.flickr.com/photos/factoryjoe/4187611971/

Chris

On Tue, Dec 15, 2009 at 10:33 AM, Don Thibeau <don@...> wrote:
Please be advised the IPR poll has closed and the vote to update the OpenID IPR process has passed.
Thanks to all who voted
Don Thibeau
_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

From forum: OpenID - General

Re: IPR Update passed

2009-12-15T13:50:43Z

Glad to see it passed!

Oddly, although I voted on the IPR poll, when I log into the membership area it says I have never voted for anything. That makes me wonder if my vote was counted (though if it wasn't, it would not have changed the outcome as I voted to accept the IPR changes) or if whatever mechanism reports on votes is broken.

On Dec 15, 2009, at 10:38 AM, Chris Messina wrote:

w00t!

Will there be a final tally and blog post put out about this (I believe there should be!)?

In the meantime, members can view the results here:

https://openid.net/foundation/members/polls/21

Non-members can view the results here:

http://www.flickr.com/photos/factoryjoe/4187611971/

Chris

On Tue, Dec 15, 2009 at 10:33 AM, Don Thibeau <don@...> wrote:
Please be advised the IPR poll has closed and the vote to update the OpenID IPR process has passed.
Thanks to all who voted
Don Thibeau
_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

From forum: OpenID - General

Re: Google Apps availability broadcasting

2009-12-15T12:36:32Z

We need to enhance the OpenID spec so that active clients can work. Discovering that the user has navigated to an RP and might want to log in is not standardized right now.

-- Dick

On 2009-12-14, at 11:23 AM, John Bradley wrote:

We currently have two different openID selectors making the rounds.

One from MS for IE and one from Higgins.

At the NIH iTrust event last week we demoed both selectors and received a good response.

The two selectors use slightly different approaches. The MS one is using a object tag and the Higgins one is looking for a link to XRD/S meta-data.

They both use unsolicited positive assertions.

The ICAM profile for openID allows for that. (Whoever wrote that profile must have known something:)

MS has indicated that if there is enough interest in the idea they will add it to there existing platform.
If people want it send in your cards and letters to MS.

While a smart client is required to provide ease of use with privacy, we can't loose sight of having a good RP hosted experience. Unfortunately that will always be subject to phishing attacks and a limitation on the OP who can have one click buttons in the UI.

John B.

On 2009-12-14, at 3:52 PM, Drummond Reed wrote:

I just want to reinforce the point that there are serious privacy issues (not to mention security issues) with an RP being able to discovery the OPs a user uses (let alone the OPs the user is currently logged in with) without the user opting in to grant permission to the RP to know that.

I know it's not very helpful to say, "This problem is much more easily solved - without any of the attendant privacy risks - with an active client", but based on my experience (folks like the Liberty Alliance tried to solve this problem for three years to no avail), it may just be than an active client is the place to focus time/attention. After IIW it appears it's inevitable that its coming, and probably built directly into the browser itself.

=Drummond

On Mon, Dec 14, 2009 at 9:52 AM, Dirk Balfanz <balfanz@...> wrote:
Breno just forwarded this thread to me. Bizarrely, even though I'm subscribed to specs, I never get a single message from that list.

Anyway - what we demonstrated at IIW was a simple "broadcasting" of who your OP is. The RP would just do a JSONP call to a central discovery service (which would carry the user's cookies for that service with it), and the discovery service would reply with a list of OPs. As Andrew points out there are privacy issues with this approach that make it infeasible - you would either have to tell the central discovery service about your OPs, our you don't. In the former case, the identity of the OPs would be revealed to any RP that asks. Which is not good enough.

So our current thinking is to access-control this per-RP. The central discovery service would somehow know which RPs you're using (or at least which RPs you're willing to tell it about). Then, when one of those whitelisted RPs asks about your OPs (and only then), the discovery service will respond with the list of your OPs. I'd say it's still up in the air whether this can be made seamless enough so that average users can handle it. It would work for Google Apps (with Google playing the role of the central discovery service), but I'm not quite sure what it would look like in general.

As for the can-my-mother-log-in scenario: I believe the percentage of users that are already logged into their OP when they visit an RP is way above 90% in the case where that OP is something like Google.

Dirk.

On Mon, Dec 14, 2009 at 8:59 AM, Breno de Medeiros <breno@...> wrote:

---------- Forwarded message ----------
From: Andrew Arnott <andrewarnott@...>
Date: Mon, Dec 14, 2009 at 7:22 AM
Subject: Re: Google Apps availability broadcasting
To: Santosh Rajan <santrajan@...>
Cc: specs <specs@...>

I'm a bit concerned about the privacy aspect, but I'm sure regardless
of the future spec that OPs will be smart about giving the user the
option to "advertise" their login status at an OP to an untrusted RP.
As I recall the way Google resolved the privacy concern is actually
giving each domain admin the option to advertise or not to RPs.
A standard addition to the protocol would be interesting, to be sure.
However, it doesn't make as much sense out of the context of Google
Apps, since that's the only host that represents very many OP
endpoints, which is what makes it interesting for the RP to poll with
the question "hey, which OPs is the user logged into?"
>From a UI standpoint, even if it were possible for the RP to
meaningfully ask the question (of someone) "what are all the OPs the
user is logged into?", I'm dubious about the value of an RP doing so.
It wouldn't pass the "my mom can login" test if she revisited an RP,
and couldn't login because her "Google" button was missing. It
wouldn't occur to her that she has to go to Google herself and log in
there before she can log into the RP. Some OPs do that today (like
Verisign), by refusing to log a user in as part of the OpenID flow,
but it's not very user-friendly -- and that's when Verisign appears at
the RP in the first place.
Just my 2 cents.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the
death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:
>
> I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.
>
> On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:
>>
>> Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.
>> --
>> Andrew Arnott
>> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>
>>
>> On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:
>>>
>>> > The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
>>> Ok, clear. Is this the one?
>>> > openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.
>>>
>>> Cheers,
>>>
>>> Chris Obdam
>>> Stichting OpenID NL (Dutch OpenID foundation)
>>>
>>> > --
>>> > Andrew Arnott
>>> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> >
>>> >
>>> > On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
>>> > Andrew,
>>> >
>>> > That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>>> >
>>> > More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
>>> > http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>>> >
>>> > Cheers,
>>> >
>>> > Chris Obdam
>>> > Stichting OpenID NL (Dutch OpenID foundation)
>>> >
>>> > Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>>> >
>>> > > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>>> > >
>>> > > Thanks.
>>> > > --
>>> > > Andrew Arnott
>>> > > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> > > _______________________________________________
>>> > > specs mailing list
>>> > > specs@...
>>> > > http://lists.openid.net/mailman/listinfo/openid-specs
>>> >
>>> >
>>>
>>
>>
>> _______________________________________________
>> specs mailing list
>> specs@...
>> http://lists.openid.net/mailman/listinfo/openid-specs
>>
>
>
>
> --
> http://hi.im/santosh
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
--Breno

+1 (650) 214-1007 desk
+1 (408) 212-0135 (Grand Central)
MTV-41-3 : 383-A
PST (GMT-8) / PDT(GMT-7)

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: IPR Update passed

2009-12-15T10:38:40Z

w00t!

Will there be a final tally and blog post put out about this (I believe there should be!)?

In the meantime, members can view the results here:

https://openid.net/foundation/members/polls/21

Non-members can view the results here:

http://www.flickr.com/photos/factoryjoe/4187611971/

Chris

On Tue, Dec 15, 2009 at 10:33 AM, Don Thibeau <don@...> wrote:

Please be advised the IPR poll has closed and the vote to update the OpenID IPR process has passed.
Thanks to all who voted
Don Thibeau
_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

From forum: OpenID - General

IPR Update passed

2009-12-15T10:33:03Z

Please be advised the IPR poll has closed and the vote to update the OpenID IPR process has passed.
Thanks to all who voted
Don Thibeau
_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

From forum: OpenID - General

Re: [OpenID] Google Groups for your domain

2009-12-15T04:16:18Z

It is for the record, audit trail and knowledge sharing.

The motions, discussion, and the outcomes are all recorded in the
minutes, and it is going to make a good organizational knowledge.
Otherwise, somebody who joins the foundation later has to do all the
digging on the mail archive. Following minutes are going to be much
easier way to catch up as long as they are kept in minutes. Also,
everybody will know how a decision was made so it adds a bit of
transparency, too. I would call it an efficiency and transparency
mechanism rather than the negatively connotated "Bureaucracy".

Nat Sakimura (=nat)

On Tue, Dec 15, 2009 at 10:31 AM, David Recordon <recordond@...> wrote:

> Hey Nat,
> Why do we need a motion? Not a single person objected when I started
> the thread.
>
> Less bureaucracy, not more. :)
>
> --David
>
> On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:
>> Let us make this to an item for the next board meeting so that we can
>> make a motion to do it.
>>
>> I am +1 on making transition as long as it can be done smoothly.
>> At the same time, we must make a habit of doing it a bit more formally
>> than just making move.
>>
>> The same applies to the move to github from svn.openid.net.
>> (Though, this one may have some implication because it changes the domain name
>> and github is harder to go through corporate firewalls.)
>>
>> =nat
>>
>> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>>> Moving this to the board list, since I'd like to see action/outcome taken
>>> against Dave's proposal.
>>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>>
>>>> I'm going to ask the Google folks if they can set us up with a Google
>>>> Apps account and see what's involved in converting over and importing
>>>> our mailing lists.
>>>
>>> Dave: any follow up on this? What would it take to move over to Google
>>> Apps?
>>> Chris
>>>
>>> --
>>> Chris Messina
>>> Open Web Advocate
>>>
>>> Personal: http://factoryjoe.com
>>> Follow me on Twitter: http://twitter.com/chrismessina
>>>
>>> Citizen Agency: http://citizenagency.com
>>> Diso Project: http://diso-project.org
>>> OpenID Foundation: http://openid.net
>>>
>>> This email is: [ ] shareable [X] ask first [ ] private
>>>
>>> _______________________________________________
>>> board mailing list
>>> board@...
>>> http://lists.openid.net/mailman/listinfo/openid-board
>>>
>>>
>>
>>
>>
>> --
>> Nat Sakimura (=nat)
>> http://www.sakimura.org/en/
>>
>

--
Nat Sakimura (=nat)
http://www.sakimura.org/en/
_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T18:37:35Z

>> Google Group's spam handling and moderation tools aren't perfect, but they destroy Mailman's from a day-to-day mgmt perspective.

There was apparently some massive improvement in spam handling pushed out last week to Google Groups. I don't know that team will, but I heard they had a big party after seeing the results.

On Mon, Dec 14, 2009 at 6:29 PM, Chris Messina <chris.messina@...> wrote:

+1 to preserving the archive links, of course.

I'll add that having to moderate lists using Mailman gives me a conniption.

Google Group's spam handling and moderation tools aren't perfect, but they destroy Mailman's from a day-to-day mgmt perspective.

Chris

On Mon, Dec 14, 2009 at 6:05 PM, David Recordon <recordond@...> wrote:

Yes, I don't see how we could make this change without both preserving
the archives at their current URLs and importing the mailing list
history into the new groups.

--David

On Tue, Dec 15, 2009 at 2:02 AM, Mike Jones <Michael.Jones@...> wrote:
> Would the existing archives be preserved, including the links to the messages? They're an important part of the archives of the organization, and I would be against a change where they're lost.
>
> -- Mike
>
> -----Original Message-----
> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
> Sent: Monday, December 14, 2009 5:44 PM
> To: openid-board@...
> Cc: OpenID Board (public)
> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>
> Hey Mike,
> Mailman is quite painful to administer and the web archives are
> archaic. Google Groups removes all of the administration headaches,
> makes it drastically easier to moderate a mailing list, and provides a
> modern public web interface which includes powerful search
> functionality.
>
> The only reason we didn't move to Google Groups a few years ago was
> that they weren't offerred on your own domain name.
>
> --David
>
> On Tue, Dec 15, 2009 at 1:41 AM, Mike Jones <Michael.Jones@...> wrote:
>> Maybe I missed the thread, but what is the advantage of making a change when we already have working mailing lists? There seems like more risk than benefit to doing this.
>>
>> -- Mike
>>
>> -----Original Message-----
>> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
>> Sent: Monday, December 14, 2009 5:32 PM
>> To: Nat Sakimura
>> Cc: OpenID Board (public); openid-board@...
>> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>>
>> Hey Nat,
>> Why do we need a motion? Not a single person objected when I started
>> the thread.
>>
>> Less bureaucracy, not more. :)
>>
>> --David
>>
>> On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:
>>> Let us make this to an item for the next board meeting so that we can
>>> make a motion to do it.
>>>
>>> I am +1 on making transition as long as it can be done smoothly.
>>> At the same time, we must make a habit of doing it a bit more formally
>>> than just making move.
>>>
>>> The same applies to the move to github from svn.openid.net.
>>> (Though, this one may have some implication because it changes the domain name
>>> and github is harder to go through corporate firewalls.)
>>>
>>> =nat
>>>
>>> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>>>> Moving this to the board list, since I'd like to see action/outcome taken
>>>> against Dave's proposal.
>>>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>>>
>>>>> I'm going to ask the Google folks if they can set us up with a Google
>>>>> Apps account and see what's involved in converting over and importing
>>>>> our mailing lists.
>>>>
>>>> Dave: any follow up on this? What would it take to move over to Google
>>>> Apps?
>>>> Chris
>>>>
>>>> --
>>>> Chris Messina
>>>> Open Web Advocate
>>>>
>>>> Personal: http://factoryjoe.com
>>>> Follow me on Twitter: http://twitter.com/chrismessina
>>>>
>>>> Citizen Agency: http://citizenagency.com
>>>> Diso Project: http://diso-project.org
>>>> OpenID Foundation: http://openid.net
>>>>
>>>> This email is: [ ] shareable [X] ask first [ ] private
>>>>
>>>> _______________________________________________
>>>> board mailing list
>>>> board@...
>>>> http://lists.openid.net/mailman/listinfo/openid-board
>>>>
>>>>
>>>
>>>
>>>
>>> --
>>> Nat Sakimura (=nat)
>>> http://www.sakimura.org/en/
>>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T18:29:16Z

+1 to preserving the archive links, of course.

I'll add that having to moderate lists using Mailman gives me a conniption.

Google Group's spam handling and moderation tools aren't perfect, but they destroy Mailman's from a day-to-day mgmt perspective.

Chris

On Mon, Dec 14, 2009 at 6:05 PM, David Recordon <recordond@...> wrote:

Yes, I don't see how we could make this change without both preserving
the archives at their current URLs and importing the mailing list
history into the new groups.

--David

On Tue, Dec 15, 2009 at 2:02 AM, Mike Jones <Michael.Jones@...> wrote:
> Would the existing archives be preserved, including the links to the messages? They're an important part of the archives of the organization, and I would be against a change where they're lost.
>
> -- Mike
>
> -----Original Message-----
> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
> Sent: Monday, December 14, 2009 5:44 PM
> To: openid-board@...
> Cc: OpenID Board (public)
> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>
> Hey Mike,
> Mailman is quite painful to administer and the web archives are
> archaic. Google Groups removes all of the administration headaches,
> makes it drastically easier to moderate a mailing list, and provides a
> modern public web interface which includes powerful search
> functionality.
>
> The only reason we didn't move to Google Groups a few years ago was
> that they weren't offerred on your own domain name.
>
> --David
>
> On Tue, Dec 15, 2009 at 1:41 AM, Mike Jones <Michael.Jones@...> wrote:
>> Maybe I missed the thread, but what is the advantage of making a change when we already have working mailing lists? There seems like more risk than benefit to doing this.
>>
>> -- Mike
>>
>> -----Original Message-----
>> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
>> Sent: Monday, December 14, 2009 5:32 PM
>> To: Nat Sakimura
>> Cc: OpenID Board (public); openid-board@...
>> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>>
>> Hey Nat,
>> Why do we need a motion? Not a single person objected when I started
>> the thread.
>>
>> Less bureaucracy, not more. :)
>>
>> --David
>>
>> On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:
>>> Let us make this to an item for the next board meeting so that we can
>>> make a motion to do it.
>>>
>>> I am +1 on making transition as long as it can be done smoothly.
>>> At the same time, we must make a habit of doing it a bit more formally
>>> than just making move.
>>>
>>> The same applies to the move to github from svn.openid.net.
>>> (Though, this one may have some implication because it changes the domain name
>>> and github is harder to go through corporate firewalls.)
>>>
>>> =nat
>>>
>>> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>>>> Moving this to the board list, since I'd like to see action/outcome taken
>>>> against Dave's proposal.
>>>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>>>
>>>>> I'm going to ask the Google folks if they can set us up with a Google
>>>>> Apps account and see what's involved in converting over and importing
>>>>> our mailing lists.
>>>>
>>>> Dave: any follow up on this? What would it take to move over to Google
>>>> Apps?
>>>> Chris
>>>>
>>>> --
>>>> Chris Messina
>>>> Open Web Advocate
>>>>
>>>> Personal: http://factoryjoe.com
>>>> Follow me on Twitter: http://twitter.com/chrismessina
>>>>
>>>> Citizen Agency: http://citizenagency.com
>>>> Diso Project: http://diso-project.org
>>>> OpenID Foundation: http://openid.net
>>>>
>>>> This email is: [ ] shareable [X] ask first [ ] private
>>>>
>>>> _______________________________________________
>>>> board mailing list
>>>> board@...
>>>> http://lists.openid.net/mailman/listinfo/openid-board
>>>>
>>>>
>>>
>>>
>>>
>>> --
>>> Nat Sakimura (=nat)
>>> http://www.sakimura.org/en/
>>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T18:05:21Z

Yes, I don't see how we could make this change without both preserving
the archives at their current URLs and importing the mailing list
history into the new groups.

--David

On Tue, Dec 15, 2009 at 2:02 AM, Mike Jones <Michael.Jones@...> wrote:

> Would the existing archives be preserved, including the links to the messages? They're an important part of the archives of the organization, and I would be against a change where they're lost.
>
> -- Mike
>
> -----Original Message-----
> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
> Sent: Monday, December 14, 2009 5:44 PM
> To: openid-board@...
> Cc: OpenID Board (public)
> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>
> Hey Mike,
> Mailman is quite painful to administer and the web archives are
> archaic. Google Groups removes all of the administration headaches,
> makes it drastically easier to moderate a mailing list, and provides a
> modern public web interface which includes powerful search
> functionality.
>
> The only reason we didn't move to Google Groups a few years ago was
> that they weren't offerred on your own domain name.
>
> --David
>
> On Tue, Dec 15, 2009 at 1:41 AM, Mike Jones <Michael.Jones@...> wrote:
>> Maybe I missed the thread, but what is the advantage of making a change when we already have working mailing lists? There seems like more risk than benefit to doing this.
>>
>> -- Mike
>>
>> -----Original Message-----
>> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
>> Sent: Monday, December 14, 2009 5:32 PM
>> To: Nat Sakimura
>> Cc: OpenID Board (public); openid-board@...
>> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>>
>> Hey Nat,
>> Why do we need a motion? Not a single person objected when I started
>> the thread.
>>
>> Less bureaucracy, not more. :)
>>
>> --David
>>
>> On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:
>>> Let us make this to an item for the next board meeting so that we can
>>> make a motion to do it.
>>>
>>> I am +1 on making transition as long as it can be done smoothly.
>>> At the same time, we must make a habit of doing it a bit more formally
>>> than just making move.
>>>
>>> The same applies to the move to github from svn.openid.net.
>>> (Though, this one may have some implication because it changes the domain name
>>> and github is harder to go through corporate firewalls.)
>>>
>>> =nat
>>>
>>> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>>>> Moving this to the board list, since I'd like to see action/outcome taken
>>>> against Dave's proposal.
>>>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>>>
>>>>> I'm going to ask the Google folks if they can set us up with a Google
>>>>> Apps account and see what's involved in converting over and importing
>>>>> our mailing lists.
>>>>
>>>> Dave: any follow up on this? What would it take to move over to Google
>>>> Apps?
>>>> Chris
>>>>
>>>> --
>>>> Chris Messina
>>>> Open Web Advocate
>>>>
>>>> Personal: http://factoryjoe.com
>>>> Follow me on Twitter: http://twitter.com/chrismessina
>>>>
>>>> Citizen Agency: http://citizenagency.com
>>>> Diso Project: http://diso-project.org
>>>> OpenID Foundation: http://openid.net
>>>>
>>>> This email is: [ ] shareable [X] ask first [ ] private
>>>>
>>>> _______________________________________________
>>>> board mailing list
>>>> board@...
>>>> http://lists.openid.net/mailman/listinfo/openid-board
>>>>
>>>>
>>>
>>>
>>>
>>> --
>>> Nat Sakimura (=nat)
>>> http://www.sakimura.org/en/
>>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T18:02:43Z

Would the existing archives be preserved, including the links to the messages? They're an important part of the archives of the organization, and I would be against a change where they're lost.

-- Mike

-----Original Message-----
From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
Sent: Monday, December 14, 2009 5:44 PM
To: openid-board@...
Cc: OpenID Board (public)
Subject: Re: [OpenID board] [OpenID] Google Groups for your domain

Hey Mike,
Mailman is quite painful to administer and the web archives are
archaic. Google Groups removes all of the administration headaches,
makes it drastically easier to moderate a mailing list, and provides a
modern public web interface which includes powerful search
functionality.

The only reason we didn't move to Google Groups a few years ago was
that they weren't offerred on your own domain name.

--David

On Tue, Dec 15, 2009 at 1:41 AM, Mike Jones <Michael.Jones@...> wrote:

> Maybe I missed the thread, but what is the advantage of making a change when we already have working mailing lists? There seems like more risk than benefit to doing this.
>
> -- Mike
>
> -----Original Message-----
> From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
> Sent: Monday, December 14, 2009 5:32 PM
> To: Nat Sakimura
> Cc: OpenID Board (public); openid-board@...
> Subject: Re: [OpenID board] [OpenID] Google Groups for your domain
>
> Hey Nat,
> Why do we need a motion? Not a single person objected when I started
> the thread.
>
> Less bureaucracy, not more. :)
>
> --David
>
> On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:
>> Let us make this to an item for the next board meeting so that we can
>> make a motion to do it.
>>
>> I am +1 on making transition as long as it can be done smoothly.
>> At the same time, we must make a habit of doing it a bit more formally
>> than just making move.
>>
>> The same applies to the move to github from svn.openid.net.
>> (Though, this one may have some implication because it changes the domain name
>> and github is harder to go through corporate firewalls.)
>>
>> =nat
>>
>> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>>> Moving this to the board list, since I'd like to see action/outcome taken
>>> against Dave's proposal.
>>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>>
>>>> I'm going to ask the Google folks if they can set us up with a Google
>>>> Apps account and see what's involved in converting over and importing
>>>> our mailing lists.
>>>
>>> Dave: any follow up on this? What would it take to move over to Google
>>> Apps?
>>> Chris
>>>
>>> --
>>> Chris Messina
>>> Open Web Advocate
>>>
>>> Personal: http://factoryjoe.com
>>> Follow me on Twitter: http://twitter.com/chrismessina
>>>
>>> Citizen Agency: http://citizenagency.com
>>> Diso Project: http://diso-project.org
>>> OpenID Foundation: http://openid.net
>>>
>>> This email is: [ ] shareable [X] ask first [ ] private
>>>
>>> _______________________________________________
>>> board mailing list
>>> board@...
>>> http://lists.openid.net/mailman/listinfo/openid-board
>>>
>>>
>>
>>
>>
>> --
>> Nat Sakimura (=nat)
>> http://www.sakimura.org/en/
>>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T17:44:00Z

Hey Mike,
Mailman is quite painful to administer and the web archives are
archaic. Google Groups removes all of the administration headaches,
makes it drastically easier to moderate a mailing list, and provides a
modern public web interface which includes powerful search
functionality.

The only reason we didn't move to Google Groups a few years ago was
that they weren't offerred on your own domain name.

--David

On Tue, Dec 15, 2009 at 1:41 AM, Mike Jones <Michael.Jones@...> wrote:

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T17:41:09Z

Maybe I missed the thread, but what is the advantage of making a change when we already have working mailing lists? There seems like more risk than benefit to doing this.

-- Mike

-----Original Message-----
From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
Sent: Monday, December 14, 2009 5:32 PM
To: Nat Sakimura
Cc: OpenID Board (public); openid-board@...
Subject: Re: [OpenID board] [OpenID] Google Groups for your domain

Hey Nat,
Why do we need a motion? Not a single person objected when I started
the thread.

Less bureaucracy, not more. :)

--David

On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:

> Let us make this to an item for the next board meeting so that we can
> make a motion to do it.
>
> I am +1 on making transition as long as it can be done smoothly.
> At the same time, we must make a habit of doing it a bit more formally
> than just making move.
>
> The same applies to the move to github from svn.openid.net.
> (Though, this one may have some implication because it changes the domain name
> and github is harder to go through corporate firewalls.)
>
> =nat
>
> On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:
>> Moving this to the board list, since I'd like to see action/outcome taken
>> against Dave's proposal.
>> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>>
>>> I'm going to ask the Google folks if they can set us up with a Google
>>> Apps account and see what's involved in converting over and importing
>>> our mailing lists.
>>
>> Dave: any follow up on this? What would it take to move over to Google
>> Apps?
>> Chris
>>
>> --
>> Chris Messina
>> Open Web Advocate
>>
>> Personal: http://factoryjoe.com
>> Follow me on Twitter: http://twitter.com/chrismessina
>>
>> Citizen Agency: http://citizenagency.com
>> Diso Project: http://diso-project.org
>> OpenID Foundation: http://openid.net
>>
>> This email is: [ ] shareable [X] ask first [ ] private
>>
>> _______________________________________________
>> board mailing list
>> board@...
>> http://lists.openid.net/mailman/listinfo/openid-board
>>
>>
>
>
>
> --
> Nat Sakimura (=nat)
> http://www.sakimura.org/en/
>

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T17:31:55Z

Hey Nat,
Why do we need a motion? Not a single person objected when I started
the thread.

Less bureaucracy, not more. :)

--David

On Tue, Dec 15, 2009 at 12:59 AM, Nat Sakimura <sakimura@...> wrote:

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T16:59:43Z

Let us make this to an item for the next board meeting so that we can
make a motion to do it.

I am +1 on making transition as long as it can be done smoothly.
At the same time, we must make a habit of doing it a bit more formally
than just making move.

The same applies to the move to github from svn.openid.net.
(Though, this one may have some implication because it changes the domain name
and github is harder to go through corporate firewalls.)

=nat

On Tue, Dec 15, 2009 at 9:33 AM, Chris Messina <chris.messina@...> wrote:

> Moving this to the board list, since I'd like to see action/outcome taken
> against Dave's proposal.
> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>>
>> I'm going to ask the Google folks if they can set us up with a Google
>> Apps account and see what's involved in converting over and importing
>> our mailing lists.
>
> Dave: any follow up on this? What would it take to move over to Google
> Apps?
> Chris
>
> --
> Chris Messina
> Open Web Advocate
>
> Personal: http://factoryjoe.com
> Follow me on Twitter: http://twitter.com/chrismessina
>
> Citizen Agency: http://citizenagency.com
> Diso Project: http://diso-project.org
> OpenID Foundation: http://openid.net
>
> This email is: [ ] shareable [X] ask first [ ] private
>
> _______________________________________________
> board mailing list
> board@...
> http://lists.openid.net/mailman/listinfo/openid-board
>
>

--
Nat Sakimura (=nat)
http://www.sakimura.org/en/
_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: Google Groups for your domain

2009-12-14T16:56:53Z

My doing it. :)

On 12/14/09, Chris Messina <chris.messina@...> wrote:

> Moving this to the board list, since I'd like to see action/outcome taken
> against Dave's proposal.
>
> On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:
>
>>
>> I'm going to ask the Google folks if they can set us up with a Google
>> Apps account and see what's involved in converting over and importing
>> our mailing lists.
>>
>
> Dave: any follow up on this? What would it take to move over to Google
> Apps?
>
> Chris
>
> --
> Chris Messina
> Open Web Advocate
>
> Personal: http://factoryjoe.com
> Follow me on Twitter: http://twitter.com/chrismessina
>
> Citizen Agency: http://citizenagency.com
> Diso Project: http://diso-project.org
> OpenID Foundation: http://openid.net
>
> This email is: [ ] shareable [X] ask first [ ] private
>

--
Sent from my mobile device
_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [OpenID] Google Groups for your domain

2009-12-14T16:33:35Z

Moving this to the board list, since I'd like to see action/outcome taken against Dave's proposal.

On Tue, Dec 8, 2009 at 9:19 PM, David Recordon <recordond@...> wrote:

I'm going to ask the Google folks if they can set us up with a Google
Apps account and see what's involved in converting over and importing
our mailing lists.

Dave: any follow up on this? What would it take to move over to Google Apps?

Chris

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: Google Apps availability broadcasting

2009-12-14T11:37:31Z

On Mon, Dec 14, 2009 at 09:52:47AM -0800, Dirk Balfanz wrote:

> Anyway - what we demonstrated at IIW was a simple "broadcasting" of who your
> OP is. The RP would just do a JSONP call to a central discovery service
> (which would carry the user's cookies for that service with it), and the
> discovery service would reply with a list of OPs. As Andrew points out there
> are privacy issues with this approach that make it infeasible - you would
> either have to tell the central discovery service about your OPs, our you
> don't. In the former case, the identity of the OPs would be revealed to any
> RP that asks. Which is not good enough.

Isn't there another privacy issue here -- that the central discovery service
learns what RP sites the user visits? It's not just that I don't want any old
RP knowing what OPs I'm logged into (OPs leaking info to RPs), I also don't
want mega-OPs like Google discovering what RP sites I frequent (RPs leaking
info to OPs).

This RP-to-OP leakage could be a tougher problem to solve -- it's
straighforward for an OP to provide preferences to known users, but it's
impossible for an RP to know that a certain as-yet-unknown party doesn't
want the Google discovery service being involved.

It would be easier to fix the RP-to-OP leakage if this mechanism was described
in a formal spec, as that should facilitate development of browser add-ons to
address privacy concerns.

Better still would be to define this information as something to be provided
by the User Agent / web browser. That would give the most efficient use of
resources (no pinging OPs or discovery services that aren't being used), and
would make it easiest for end users to retain control over all the privacy
implications. Yes, it would mean a big hurdle for implementation, especially
if there was any trouble getting Microsoft, Mozilla, or Apple to incorporate
the features in their web browsers.

-Peter

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T11:23:54Z

We currently have two different openID selectors making the rounds.

One from MS for IE and one from Higgins.

At the NIH iTrust event last week we demoed both selectors and received a good response.

The two selectors use slightly different approaches. The MS one is using a object tag and the Higgins one is looking for a link to XRD/S meta-data.

They both use unsolicited positive assertions.

The ICAM profile for openID allows for that. (Whoever wrote that profile must have known something:)

MS has indicated that if there is enough interest in the idea they will add it to there existing platform.

If people want it send in your cards and letters to MS.

While a smart client is required to provide ease of use with privacy, we can't loose sight of having a good RP hosted experience. Unfortunately that will always be subject to phishing attacks and a limitation on the OP who can have one click buttons in the UI.

John B.

On 2009-12-14, at 3:52 PM, Drummond Reed wrote:

I just want to reinforce the point that there are serious privacy issues (not to mention security issues) with an RP being able to discovery the OPs a user uses (let alone the OPs the user is currently logged in with) without the user opting in to grant permission to the RP to know that.

I know it's not very helpful to say, "This problem is much more easily solved - without any of the attendant privacy risks - with an active client", but based on my experience (folks like the Liberty Alliance tried to solve this problem for three years to no avail), it may just be than an active client is the place to focus time/attention. After IIW it appears it's inevitable that its coming, and probably built directly into the browser itself.

=Drummond

On Mon, Dec 14, 2009 at 9:52 AM, Dirk Balfanz <balfanz@...> wrote:
Breno just forwarded this thread to me. Bizarrely, even though I'm subscribed to specs, I never get a single message from that list.

Anyway - what we demonstrated at IIW was a simple "broadcasting" of who your OP is. The RP would just do a JSONP call to a central discovery service (which would carry the user's cookies for that service with it), and the discovery service would reply with a list of OPs. As Andrew points out there are privacy issues with this approach that make it infeasible - you would either have to tell the central discovery service about your OPs, our you don't. In the former case, the identity of the OPs would be revealed to any RP that asks. Which is not good enough.

So our current thinking is to access-control this per-RP. The central discovery service would somehow know which RPs you're using (or at least which RPs you're willing to tell it about). Then, when one of those whitelisted RPs asks about your OPs (and only then), the discovery service will respond with the list of your OPs. I'd say it's still up in the air whether this can be made seamless enough so that average users can handle it. It would work for Google Apps (with Google playing the role of the central discovery service), but I'm not quite sure what it would look like in general.

As for the can-my-mother-log-in scenario: I believe the percentage of users that are already logged into their OP when they visit an RP is way above 90% in the case where that OP is something like Google.

Dirk.

On Mon, Dec 14, 2009 at 8:59 AM, Breno de Medeiros <breno@...> wrote:

---------- Forwarded message ----------
From: Andrew Arnott <andrewarnott@...>
Date: Mon, Dec 14, 2009 at 7:22 AM
Subject: Re: Google Apps availability broadcasting
To: Santosh Rajan <santrajan@...>
Cc: specs <specs@...>

I'm a bit concerned about the privacy aspect, but I'm sure regardless
of the future spec that OPs will be smart about giving the user the
option to "advertise" their login status at an OP to an untrusted RP.
As I recall the way Google resolved the privacy concern is actually
giving each domain admin the option to advertise or not to RPs.
A standard addition to the protocol would be interesting, to be sure.
However, it doesn't make as much sense out of the context of Google
Apps, since that's the only host that represents very many OP
endpoints, which is what makes it interesting for the RP to poll with
the question "hey, which OPs is the user logged into?"
>From a UI standpoint, even if it were possible for the RP to
meaningfully ask the question (of someone) "what are all the OPs the
user is logged into?", I'm dubious about the value of an RP doing so.
It wouldn't pass the "my mom can login" test if she revisited an RP,
and couldn't login because her "Google" button was missing. It
wouldn't occur to her that she has to go to Google herself and log in
there before she can log into the RP. Some OPs do that today (like
Verisign), by refusing to log a user in as part of the OpenID flow,
but it's not very user-friendly -- and that's when Verisign appears at
the RP in the first place.
Just my 2 cents.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the
death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:
>
> I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.
>
> On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:
>>
>> Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.
>> --
>> Andrew Arnott
>> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>
>>
>> On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:
>>>
>>> > The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
>>> Ok, clear. Is this the one?
>>> > openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.
>>>
>>> Cheers,
>>>
>>> Chris Obdam
>>> Stichting OpenID NL (Dutch OpenID foundation)
>>>
>>> > --
>>> > Andrew Arnott
>>> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> >
>>> >
>>> > On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
>>> > Andrew,
>>> >
>>> > That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>>> >
>>> > More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
>>> > http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>>> >
>>> > Cheers,
>>> >
>>> > Chris Obdam
>>> > Stichting OpenID NL (Dutch OpenID foundation)
>>> >
>>> > Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>>> >
>>> > > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>>> > >
>>> > > Thanks.
>>> > > --
>>> > > Andrew Arnott
>>> > > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> > > _______________________________________________
>>> > > specs mailing list
>>> > > specs@...
>>> > > http://lists.openid.net/mailman/listinfo/openid-specs
>>> >
>>> >
>>>
>>
>>
>> _______________________________________________
>> specs mailing list
>> specs@...
>> http://lists.openid.net/mailman/listinfo/openid-specs
>>
>
>
>
> --
> http://hi.im/santosh
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
--Breno

+1 (650) 214-1007 desk
+1 (408) 212-0135 (Grand Central)
MTV-41-3 : 383-A
PST (GMT-8) / PDT(GMT-7)

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T10:52:05Z

I just want to reinforce the point that there are serious privacy issues (not to mention security issues) with an RP being able to discovery the OPs a user uses (let alone the OPs the user is currently logged in with) without the user opting in to grant permission to the RP to know that.

I know it's not very helpful to say, "This problem is much more easily solved - without any of the attendant privacy risks - with an active client", but based on my experience (folks like the Liberty Alliance tried to solve this problem for three years to no avail), it may just be than an active client is the place to focus time/attention. After IIW it appears it's inevitable that its coming, and probably built directly into the browser itself.

=Drummond

On Mon, Dec 14, 2009 at 9:52 AM, Dirk Balfanz <balfanz@...> wrote:

Breno just forwarded this thread to me. Bizarrely, even though I'm subscribed to specs, I never get a single message from that list.

Anyway - what we demonstrated at IIW was a simple "broadcasting" of who your OP is. The RP would just do a JSONP call to a central discovery service (which would carry the user's cookies for that service with it), and the discovery service would reply with a list of OPs. As Andrew points out there are privacy issues with this approach that make it infeasible - you would either have to tell the central discovery service about your OPs, our you don't. In the former case, the identity of the OPs would be revealed to any RP that asks. Which is not good enough.

So our current thinking is to access-control this per-RP. The central discovery service would somehow know which RPs you're using (or at least which RPs you're willing to tell it about). Then, when one of those whitelisted RPs asks about your OPs (and only then), the discovery service will respond with the list of your OPs. I'd say it's still up in the air whether this can be made seamless enough so that average users can handle it. It would work for Google Apps (with Google playing the role of the central discovery service), but I'm not quite sure what it would look like in general.

As for the can-my-mother-log-in scenario: I believe the percentage of users that are already logged into their OP when they visit an RP is way above 90% in the case where that OP is something like Google.

Dirk.

On Mon, Dec 14, 2009 at 8:59 AM, Breno de Medeiros <breno@...> wrote:

---------- Forwarded message ----------
From: Andrew Arnott <andrewarnott@...>
Date: Mon, Dec 14, 2009 at 7:22 AM
Subject: Re: Google Apps availability broadcasting
To: Santosh Rajan <santrajan@...>
Cc: specs <specs@...>

I'm a bit concerned about the privacy aspect, but I'm sure regardless
of the future spec that OPs will be smart about giving the user the
option to "advertise" their login status at an OP to an untrusted RP.
As I recall the way Google resolved the privacy concern is actually
giving each domain admin the option to advertise or not to RPs.
A standard addition to the protocol would be interesting, to be sure.
However, it doesn't make as much sense out of the context of Google
Apps, since that's the only host that represents very many OP
endpoints, which is what makes it interesting for the RP to poll with
the question "hey, which OPs is the user logged into?"
>From a UI standpoint, even if it were possible for the RP to
meaningfully ask the question (of someone) "what are all the OPs the
user is logged into?", I'm dubious about the value of an RP doing so.
It wouldn't pass the "my mom can login" test if she revisited an RP,
and couldn't login because her "Google" button was missing. It
wouldn't occur to her that she has to go to Google herself and log in
there before she can log into the RP. Some OPs do that today (like
Verisign), by refusing to log a user in as part of the OpenID flow,
but it's not very user-friendly -- and that's when Verisign appears at
the RP in the first place.
Just my 2 cents.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the
death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:
>
> I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.
>
> On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:
>>
>> Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.
>> --
>> Andrew Arnott
>> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>
>>
>> On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:
>>>
>>> > The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
>>> Ok, clear. Is this the one?
>>> > openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.
>>>
>>> Cheers,
>>>
>>> Chris Obdam
>>> Stichting OpenID NL (Dutch OpenID foundation)
>>>
>>> > --
>>> > Andrew Arnott
>>> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> >
>>> >
>>> > On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
>>> > Andrew,
>>> >
>>> > That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>>> >
>>> > More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
>>> > http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>>> >
>>> > Cheers,
>>> >
>>> > Chris Obdam
>>> > Stichting OpenID NL (Dutch OpenID foundation)
>>> >
>>> > Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>>> >
>>> > > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>>> > >
>>> > > Thanks.
>>> > > --
>>> > > Andrew Arnott
>>> > > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> > > _______________________________________________
>>> > > specs mailing list
>>> > > specs@...
>>> > > http://lists.openid.net/mailman/listinfo/openid-specs
>>> >
>>> >
>>>
>>
>>
>> _______________________________________________
>> specs mailing list
>> specs@...
>> http://lists.openid.net/mailman/listinfo/openid-specs
>>
>
>
>
> --
> http://hi.im/santosh
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
--Breno

+1 (650) 214-1007 desk
+1 (408) 212-0135 (Grand Central)
MTV-41-3 : 383-A
PST (GMT-8) / PDT(GMT-7)

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T09:52:47Z

Breno just forwarded this thread to me. Bizarrely, even though I'm subscribed to specs, I never get a single message from that list.

Anyway - what we demonstrated at IIW was a simple "broadcasting" of who your OP is. The RP would just do a JSONP call to a central discovery service (which would carry the user's cookies for that service with it), and the discovery service would reply with a list of OPs. As Andrew points out there are privacy issues with this approach that make it infeasible - you would either have to tell the central discovery service about your OPs, our you don't. In the former case, the identity of the OPs would be revealed to any RP that asks. Which is not good enough.

So our current thinking is to access-control this per-RP. The central discovery service would somehow know which RPs you're using (or at least which RPs you're willing to tell it about). Then, when one of those whitelisted RPs asks about your OPs (and only then), the discovery service will respond with the list of your OPs. I'd say it's still up in the air whether this can be made seamless enough so that average users can handle it. It would work for Google Apps (with Google playing the role of the central discovery service), but I'm not quite sure what it would look like in general.

As for the can-my-mother-log-in scenario: I believe the percentage of users that are already logged into their OP when they visit an RP is way above 90% in the case where that OP is something like Google.

Dirk.

On Mon, Dec 14, 2009 at 8:59 AM, Breno de Medeiros <breno@...> wrote:

---------- Forwarded message ----------
From: Andrew Arnott <andrewarnott@...>
Date: Mon, Dec 14, 2009 at 7:22 AM
Subject: Re: Google Apps availability broadcasting
To: Santosh Rajan <santrajan@...>
Cc: specs <specs@...>

I'm a bit concerned about the privacy aspect, but I'm sure regardless
of the future spec that OPs will be smart about giving the user the
option to "advertise" their login status at an OP to an untrusted RP.
As I recall the way Google resolved the privacy concern is actually
giving each domain admin the option to advertise or not to RPs.
A standard addition to the protocol would be interesting, to be sure.
However, it doesn't make as much sense out of the context of Google
Apps, since that's the only host that represents very many OP
endpoints, which is what makes it interesting for the RP to poll with
the question "hey, which OPs is the user logged into?"
>From a UI standpoint, even if it were possible for the RP to
meaningfully ask the question (of someone) "what are all the OPs the
user is logged into?", I'm dubious about the value of an RP doing so.
It wouldn't pass the "my mom can login" test if she revisited an RP,
and couldn't login because her "Google" button was missing. It
wouldn't occur to her that she has to go to Google herself and log in
there before she can log into the RP. Some OPs do that today (like
Verisign), by refusing to log a user in as part of the OpenID flow,
but it's not very user-friendly -- and that's when Verisign appears at
the RP in the first place.
Just my 2 cents.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the
death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:
>
> I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.
>
> On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:
>>
>> Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.
>> --
>> Andrew Arnott
>> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>
>>
>> On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:
>>>
>>> > The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
>>> Ok, clear. Is this the one?
>>> > openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.
>>>
>>> Cheers,
>>>
>>> Chris Obdam
>>> Stichting OpenID NL (Dutch OpenID foundation)
>>>
>>> > --
>>> > Andrew Arnott
>>> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> >
>>> >
>>> > On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
>>> > Andrew,
>>> >
>>> > That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>>> >
>>> > More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
>>> > http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>>> >
>>> > Cheers,
>>> >
>>> > Chris Obdam
>>> > Stichting OpenID NL (Dutch OpenID foundation)
>>> >
>>> > Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>>> >
>>> > > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>>> > >
>>> > > Thanks.
>>> > > --
>>> > > Andrew Arnott
>>> > > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>>> > > _______________________________________________
>>> > > specs mailing list
>>> > > specs@...
>>> > > http://lists.openid.net/mailman/listinfo/openid-specs
>>> >
>>> >
>>>
>>
>>
>> _______________________________________________
>> specs mailing list
>> specs@...
>> http://lists.openid.net/mailman/listinfo/openid-specs
>>
>
>
>
> --
> http://hi.im/santosh
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
--Breno

+1 (650) 214-1007 desk
+1 (408) 212-0135 (Grand Central)
MTV-41-3 : 383-A
PST (GMT-8) / PDT(GMT-7)

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T07:39:06Z

Wow, good argument Andrew. Maybe we need to look into the percentages/chances that a user is already logged into one of the RP's. I mean if the chances that the user is already logged into "Facebook, Google, Microsoft, Yahoo (this is in alphabetic order)" is > 25%, then it might be worth while that we seriously consider this. Of course this heavily favors the big guys, but I think accepting reality might be in order here. What do you think?

On Mon, Dec 14, 2009 at 8:52 PM, Andrew Arnott <andrewarnott@...> wrote:

I'm a bit concerned about the privacy aspect, but I'm sure regardless of the future spec that OPs will be smart about giving the user the option to "advertise" their login status at an OP to an untrusted RP. As I recall the way Google resolved the privacy concern is actually giving each domain admin the option to advertise or not to RPs.

A standard addition to the protocol would be interesting, to be sure. However, it doesn't make as much sense out of the context of Google Apps, since that's the only host that represents very many OP endpoints, which is what makes it interesting for the RP to poll with the question "hey, which OPs is the user logged into?"

From a UI standpoint, even if it were possible for the RP to meaningfully ask the question (of someone) "what are all the OPs the user is logged into?", I'm dubious about the value of an RP doing so. It wouldn't pass the "my mom can login" test if she revisited an RP, and couldn't login because her "Google" button was missing. It wouldn't occur to her that she has to go to Google herself and log in there before she can log into the RP. Some OPs do that today (like Verisign), by refusing to log a user in as part of the OpenID flow, but it's not very user-friendly -- and that's when Verisign appears at the RP in the first place.

Just my 2 cents.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:

I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.

On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:

Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:

> The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.

Ok, clear. Is this the one?
> openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>
>
> On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
> Andrew,
>
> That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>
> More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
> http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>
> Cheers,
>
> Chris Obdam
> Stichting OpenID NL (Dutch OpenID foundation)
>
> Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>
> > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
> >
> > Thanks.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> > _______________________________________________
> > specs mailing list
> > specs@...
> > http://lists.openid.net/mailman/listinfo/openid-specs
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
http://hi.im/santosh

--
http://hi.im/santosh

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

Santosh Rajan http://santrajan.blogspot.com

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T07:22:08Z

I'm a bit concerned about the privacy aspect, but I'm sure regardless of the future spec that OPs will be smart about giving the user the option to "advertise" their login status at an OP to an untrusted RP. As I recall the way Google resolved the privacy concern is actually giving each domain admin the option to advertise or not to RPs.

A standard addition to the protocol would be interesting, to be sure. However, it doesn't make as much sense out of the context of Google Apps, since that's the only host that represents very many OP endpoints, which is what makes it interesting for the RP to poll with the question "hey, which OPs is the user logged into?"

From a UI standpoint, even if it were possible for the RP to meaningfully ask the question (of someone) "what are all the OPs the user is logged into?", I'm dubious about the value of an RP doing so. It wouldn't pass the "my mom can login" test if she revisited an RP, and couldn't login because her "Google" button was missing. It wouldn't occur to her that she has to go to Google herself and log in there before she can log into the RP. Some OPs do that today (like Verisign), by refusing to log a user in as part of the OpenID flow, but it's not very user-friendly -- and that's when Verisign appears at the RP in the first place.

Just my 2 cents.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 7:09 AM, Santosh Rajan <santrajan@...> wrote:

I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.

On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:

Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:

> The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.

Ok, clear. Is this the one?
> openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>
>
> On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
> Andrew,
>
> That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>
> More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
> http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>
> Cheers,
>
> Chris Obdam
> Stichting OpenID NL (Dutch OpenID foundation)
>
> Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>
> > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
> >
> > Thanks.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> > _______________________________________________
> > specs mailing list
> > specs@...
> > http://lists.openid.net/mailman/listinfo/openid-specs
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
http://hi.im/santosh

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T07:09:06Z

I agree with Andrew, and I think every OP must do the same. Or maybe we add that to the protocol.

On Mon, Dec 14, 2009 at 8:17 PM, Andrew Arnott <andrewarnott@...> wrote:

Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:

> The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.

Ok, clear. Is this the one?
> openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>
>
> On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
> Andrew,
>
> That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>
> More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
> http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>
> Cheers,
>
> Chris Obdam
> Stichting OpenID NL (Dutch OpenID foundation)
>
> Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>
> > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
> >
> > Thanks.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> > _______________________________________________
> > specs mailing list
> > specs@...
> > http://lists.openid.net/mailman/listinfo/openid-specs
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

--
http://hi.im/santosh

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

Santosh Rajan http://santrajan.blogspot.com

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T06:47:57Z

Nope, that's not it either. What I'm thinking of is an aid to pure login UI -- nothing to do with OAuth. And again, Google is supplying the list of Google Apps domains the user is logged into -- not the RP asking for each specific domain.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 6:32 AM, Chris Obdam <chris.obdam@...> wrote:

> The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.

Ok, clear. Is this the one?
> openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>
>
> On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
> Andrew,
>
> That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>
> More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
> http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>
> Cheers,
>
> Chris Obdam
> Stichting OpenID NL (Dutch OpenID foundation)
>
> Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>
> > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
> >
> > Thanks.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> > _______________________________________________
> > specs mailing list
> > specs@...
> > http://lists.openid.net/mailman/listinfo/openid-specs
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T06:32:17Z

> The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
Ok, clear. Is this the one?
> openid.ext2.scope - (required) List of URLs identifying the Google service(s) to be accessed. See documentation for the services of interest to get scopes must be space-delimited and properly escaped. This parameter is not defined in the OAuth standards; it is a Google-specific parameter.

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
>
>
> On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:
> Andrew,
>
> That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?
>
> More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
> http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html
>
> Cheers,
>
> Chris Obdam
> Stichting OpenID NL (Dutch OpenID foundation)
>
> Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:
>
> > At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
> >
> > Thanks.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> > _______________________________________________
> > specs mailing list
> > specs@...
> > http://lists.openid.net/mailman/listinfo/openid-specs
>
>

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T06:20:11Z

Not exactly. That variable would require the RP to ping individual OP endpoints. The solution Dirk/Breno spoke of (as I recall) was a single URL that would return all google apps for domains the user is logged into.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

On Mon, Dec 14, 2009 at 6:14 AM, Chris Obdam <chris.obdam@...> wrote:

Andrew,

That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?

More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:

> At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>
> Thanks.
> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

> _______________________________________________
> specs mailing list
> specs@...
> http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Google Apps availability broadcasting

2009-12-14T06:14:39Z

Andrew,

That sounds a lot like de openid.ui.x-has-session variable David mentioned earlier today?

More info on http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html and
http://code.google.com/intl/nl-NL/apis/accounts/docs/OpenID.html

Cheers,

Chris Obdam
Stichting OpenID NL (Dutch OpenID foundation)

Op 14 dec 2009, om 14:54 heeft Andrew Arnott het volgende geschreven:

> At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?
>
> Thanks.
> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
> _______________________________________________
> specs mailing list
> specs@...
> http://lists.openid.net/mailman/listinfo/openid-specs

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Google Apps availability broadcasting

2009-12-14T05:54:06Z

At IIW, Google mentioned that they are trying out a way for Google Apps domains to advertise to RPs that the user is logged into them so that RPs can show a "log into puffypoodles.com" option. Where can we find documentation on how that works?

Thanks.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

OP Matrix

2009-12-10T23:34:07Z

Hi,

I think the current OP Matrix is very incomplete regarding providers listed. I can't find MyOpenID, ClaimID, Clavid, XLogon, etc. Why do we only see only US based OP's on the list?

Here is the row for Clavid:

Company: Clavid
Reach - Active Users (millions): -
Reach - Key Geographies: Worldwide
Reach - Key Demographics: Swiss / EU
Identity - Open Stack: 1
Identity - Ratio of Open Stack / Proprietary usage: -
Identity - Monthly Active Users of Open Stack: -
Identity - Validated email: 2
Identity - Auto login: 1
Identity - Hybrid: 3
Identity - Profile fields: 1
Identity - Friendly UI: 1
Identity - Feed discovery: 3
API - Access to contacts: 3
API - Contacts' Email address: 3
API - Other contact info: 3
API - Del. auth API: 3
API - Long-lived tokens: 3
API - Two-way sync API: 3
API - Ability to store: 3
API - Open Stack: 3
Feeds - RSS / Atom: 3
Feeds - Rich metadata: 3
Feeds - Lookup by email: 3
Feeds - Real-time updates: 3
User Data - User Data Provided: 1- SREG Data
User Data - Supplementary Data: -
Security - PAPE support: 2
Security - Multi-factor Auth: 1
Security - Other (Describe): Biometrics (AXSionics Fingerprint), YubiKey OTP, Certificates (Hard, Soft, Self-Signed)

Regards

Robert

On 11.12.2009, at 02:40, openid-board-request@... wrote:

> Send board mailing list submissions to
> openid-board@...
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://lists.openid.net/mailman/listinfo/openid-board
> or, via email, send a message with subject or body 'help' to
> openid-board-request@...
>
> You can reach the person managing the list at
> openid-board-owner@...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of board digest..."
>
>
> Today's Topics:
>
> 1. Re: [board-private] OP Matrix (Chris Messina)

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: Yahoo available AX attrs - backchannel/endpoint URLs

2009-12-10T20:17:06Z

> My view here is that anything that is not an explicit API with a
> support SLA can be trusted to last unchanged. Clarification that the
> URL may change will probably not dissuade the RPs that don't have a
> good image hosting solution from deep linking to these images. Serving
> 3rd party images in the domain of the RP's page is actually tricky:
> Just search for GIFAR.
>

I think I messed the double negative above: I meant everything except
explicit APIs with support SLAs are liable to change.

Moreover, much of the other information transmitted via AX is also
liable to change: email address, contact information, so this should
not be treated any differently.
_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Yahoo available AX attrs - backchannel/endpoint URLs

2009-12-10T20:12:03Z

On Thu, Dec 10, 2009 at 5:43 PM, Allen Tom <atom@...> wrote:

> If I was building an RP, I would definitely download and cache the profile
> image for the privacy and security reasons that you stated.
>
> However, many RPs have asked if they can directly link to the profile pic,
> because image hosting costs money, and downloading and caching requires work
> and effort. Also, some RPs would like to have the image automatically
> updated if the user changes it.
>
> With the current Yahoo AX implementation, RPs can deep link to the profile
> image if they want to, however, the image could be deleted if the user
> changes their picture, resulting in a broken image. For the purposes of
> interop, it would be good to clarify what RPs should do with the Profile
> Image url.
>
>

Hi Allen,

My view here is that anything that is not an explicit API with a
support SLA can be trusted to last unchanged. Clarification that the
URL may change will probably not dissuade the RPs that don't have a
good image hosting solution from deep linking to these images. Serving
3rd party images in the domain of the RP's page is actually tricky:
Just search for GIFAR.
_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: Yahoo available AX attrs - backchannel/endpoint URLs

2009-12-10T17:43:43Z

If I was building an RP, I would definitely download and cache the profile
image for the privacy and security reasons that you stated.

However, many RPs have asked if they can directly link to the profile pic,
because image hosting costs money, and downloading and caching requires work
and effort. Also, some RPs would like to have the image automatically
updated if the user changes it.

With the current Yahoo AX implementation, RPs can deep link to the profile
image if they want to, however, the image could be deleted if the user
changes their picture, resulting in a broken image. For the purposes of
interop, it would be good to clarify what RPs should do with the Profile
Image url.

Allen

On 12/9/09 9:05 PM, "SitG Admin" <sysadmin@...> wrote:

>> One of the things that I'd like to clarify in AX 1.1 is whether or
>> not RPs should be able to deep link directly to the profile pic, or
>> if they're expected to download and cache it themselves. Also, if
>> RPs are able to deep link to the profile pic, then we should also
>> define whether or not the content of the URL be updated when the
>> user updates their pic.
>
> RP's should be able to cache it themselves; if you let me specify an
> avatar URL at any server I control, anyone who views a page with my
> avatar on it will probably be sending me referer metadata that can
> let me track/identify them :(
>
> -Shade

_______________________________________________
specs mailing list
specs@...
http://lists.openid.net/mailman/listinfo/openid-specs

From forum: OpenID - Specs

Re: [board-private] OP Matrix

2009-12-10T17:40:51Z

I'm happy to take a crack at it — perhaps I can do something this weekend.

Chris

On Thu, Dec 10, 2009 at 5:26 PM, Brian Kissel <bkissel@...> wrote:

Thanks to everyone for the feedback.

So is anyone willing to spend some time making the table of OP capabilities more aesthetically pleasing and adding whatever comments and disclaimers we want to add?

A lot of work has been put in by a number of people to get this working draft ready for publication. This was a specific take away action item from the IIW OP Office Hours session. It may not be perfect, and it will certainly evolve as we progress, but let’s get something that’s good enough out there to show the great progress that OPs are making and to highlight areas where we’re still expanding and improving. If we can’t find a home for it on the OIDF website, JanRain is glad to host it since our clients and prospects are always asking for this information.

Cheers,

Brian

___________

Brian Kissel

CEO, JanRain - WebID and Social Publishing for User Engagement

Email: bkissel@... Cell: 503.866.4424 Fax: 503.296.5502

From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon

Sent: Sunday, December 06, 2009 9:20 PM
To: openid-board@...
Subject: Re: [OpenID board] [board-private] OP Matrix

Moving this to the public list since broader feedback will be useful as we clean up this information. :)

Like Chris, I'm interested in seeing how we can make this information more actionable. What does this mean for a site owner when they're choosing their "nascar"? Or as a user how does this information help me choose my provider.

--David

On Sun, Dec 6, 2009 at 9:15 PM, Chris Messina <chris.messina@...> wrote:

In its current state, this matrix is likely to confuse.

As well "matrix" is not a word that I think will make sense to many people.

We currently see around 6% of our traffic going this page. The next page they visit is Getting Started (http://openid.net//add-openid/add-getting-started/). I think this kind of detailed information belongs on that page.

Concrete proposals:

1. The matrix feels more like second-tier documentation... while it is very valuable information, we should be careful about just adding links and tabs to the website without longer term consideration. Can we provide a link that reads "Learn more about current [OpenID provider capability]" at the very bottom of the "Add OpenID" page?

2. That matrix is full of information...! And ugly as heck. It's worth cleaning it up if we're going to present it for public consumption. Can we get Darrin or someone else with a design eye to take a crack at making it public-presentable?

3. Can we focus the take-aways from the matrix to a few clear items? Specifically, I think saying who provides verified email, profile data, and who has access to what number of active monthly users are the operative bits of information. The current matrix weaves together technical capabilities with stats that we can use to argue for adopting OpenID. At the very least, we need to call out the stuff that makes the [business] case for adopting OpenID in the first place, and THEN provide information that developers can use.

Happy to provide more feedback, but I do not want to see this matrix just thrown on the site because it's "data complete".

Chris

On Sun, Dec 6, 2009 at 9:01 PM, Brian Kissel <bkissel@...> wrote:

Hi Guys,

So I think we’re ready to publish the OP matrix. John, can you find a suitable place on the OIDF website to provide this text and link.

Identity Provider Capability Matrix http://spreadsheets.google.com/pub?key=tNv5ZWQD5wzK4luDFn0anmw&output=html

The following matrix attempts to characterize the offerings of many of the user managed identity providers along dimensions including user base description, identity services, address book and feed services, security, data elements supported, and security enhancements. Some of the attributes are subjective and qualitative in nature and some data may be missing for certain providers.

Definitions, descriptions, and clarifying notes for each element in the table are summarized in columns A and B under the matrix.

The intent of this document it to share the significant progress being made by each of the major identity providers in expanding and improving their offerings for the benefit of website operators and end users. This will be updated at least quarterly by each of the identity providers, so feel free to come back to find the latest information.

If there is additional information you would like to see displayed in this matrix or you feel there are errors, please provide comments below (hoping we can put a feedback tool here so users can give us direct input).

Maybe a good place would be a new top level nav entry on this page: http://openid.net/add-openid/

Insert a new tab after “Getting Started” but before “Become an OpenID Provider” that says “OpenID Provider Matrix” or something like that.

Cheers,

Brian

___________

Brian Kissel

CEO, JanRain - WebID and Social Publishing for User Engagement

5331 SW Macadam Ave., Suite 375, Portland, OR 97239

Email: bkissel@... Cell: 503.866.4424 Fax: 503.296.5502

_______________________________________________
board-private mailing list
board-private@...
http://lists.openid.net/mailman/listinfo/openid-board-private

--
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is: [ ] shareable [X] ask first [ ] private

_______________________________________________
board-private mailing list
board-private@...
http://lists.openid.net/mailman/listinfo/openid-board-private

__________ Information from ESET NOD32 Antivirus, version of virus signature database 4653 (20091201) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board

Re: [board-private] OP Matrix

2009-12-10T17:26:54Z

Thanks to everyone for the feedback.

So is anyone willing to spend some time making the table of OP capabilities more aesthetically pleasing and adding whatever comments and disclaimers we want to add?

A lot of work has been put in by a number of people to get this working draft ready for publication. This was a specific take away action item from the IIW OP Office Hours session. It may not be perfect, and it will certainly evolve as we progress, but let’s get something that’s good enough out there to show the great progress that OPs are making and to highlight areas where we’re still expanding and improving. If we can’t find a home for it on the OIDF website, JanRain is glad to host it since our clients and prospects are always asking for this information.

Cheers,

Brian

___________

Brian Kissel

CEO, JanRain - WebID and Social Publishing for User Engagement

Email: bkissel@... Cell: 503.866.4424 Fax: 503.296.5502

From: openid-board-bounces@... [mailto:openid-board-bounces@...] On Behalf Of David Recordon
Sent: Sunday, December 06, 2009 9:20 PM
To: openid-board@...
Subject: Re: [OpenID board] [board-private] OP Matrix

Moving this to the public list since broader feedback will be useful as we clean up this information. :)

Like Chris, I'm interested in seeing how we can make this information more actionable. What does this mean for a site owner when they're choosing their "nascar"? Or as a user how does this information help me choose my provider.

--David

On Sun, Dec 6, 2009 at 9:15 PM, Chris Messina <chris.messina@...> wrote:

In its current state, this matrix is likely to confuse.

As well "matrix" is not a word that I think will make sense to many people.

We currently see around 6% of our traffic going this page. The next page they visit is Getting Started (http://openid.net//add-openid/add-getting-started/). I think this kind of detailed information belongs on that page.

Concrete proposals:

1. The matrix feels more like second-tier documentation... while it is very valuable information, we should be careful about just adding links and tabs to the website without longer term consideration. Can we provide a link that reads "Learn more about current [OpenID provider capability]" at the very bottom of the "Add OpenID" page?

2. That matrix is full of information...! And ugly as heck. It's worth cleaning it up if we're going to present it for public consumption. Can we get Darrin or someone else with a design eye to take a crack at making it public-presentable?

3. Can we focus the take-aways from the matrix to a few clear items? Specifically, I think saying who provides verified email, profile data, and who has access to what number of active monthly users are the operative bits of information. The current matrix weaves together technical capabilities with stats that we can use to argue for adopting OpenID. At the very least, we need to call out the stuff that makes the [business] case for adopting OpenID in the first place, and THEN provide information that developers can use.

Happy to provide more feedback, but I do not want to see this matrix just thrown on the site because it's "data complete".

Chris

On Sun, Dec 6, 2009 at 9:01 PM, Brian Kissel <bkissel@...> wrote:

Hi Guys,

So I think we’re ready to publish the OP matrix. John, can you find a suitable place on the OIDF website to provide this text and link.

Identity Provider Capability Matrix http://spreadsheets.google.com/pub?key=tNv5ZWQD5wzK4luDFn0anmw&output=html

The following matrix attempts to characterize the offerings of many of the user managed identity providers along dimensions including user base description, identity services, address book and feed services, security, data elements supported, and security enhancements. Some of the attributes are subjective and qualitative in nature and some data may be missing for certain providers.

Definitions, descriptions, and clarifying notes for each element in the table are summarized in columns A and B under the matrix.

The intent of this document it to share the significant progress being made by each of the major identity providers in expanding and improving their offerings for the benefit of website operators and end users. This will be updated at least quarterly by each of the identity providers, so feel free to come back to find the latest information.

If there is additional information you would like to see displayed in this matrix or you feel there are errors, please provide comments below (hoping we can put a feedback tool here so users can give us direct input).

Maybe a good place would be a new top level nav entry on this page: http://openid.net/add-openid/

Insert a new tab after “Getting Started” but before “Become an OpenID Provider” that says “OpenID Provider Matrix” or something like that.

Cheers,

Brian

___________

Brian Kissel

CEO, JanRain - WebID and Social Publishing for User Engagement

5331 SW Macadam Ave., Suite 375, Portland, OR 97239

Email: bkissel@... Cell: 503.866.4424 Fax: 503.296.5502

_______________________________________________
board-private mailing list
board-private@...
http://lists.openid.net/mailman/listinfo/openid-board-private

_______________________________________________
board-private mailing list
board-private@...
http://lists.openid.net/mailman/listinfo/openid-board-private

__________ Information from ESET NOD32 Antivirus, version of virus signature database 4653 (20091201) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

_______________________________________________
board mailing list
board@...
http://lists.openid.net/mailman/listinfo/openid-board

From forum: OpenID - Foundation Board