Problem statement for Webfinger?

[Hannes Tschofenig]

Hi all,

I read throught the Webfinger description and I was trying to figure out
what the problem statement is.

I really saw only one aspect discussed in more detail, namely that URIs (as
used in OpenID) are difficult for users to understand. The usage of email
alike addresses (namely those identifiers using username@domain) would be
better.

Sounds reasonable to me.

Is this the motivation or is there more?

Ciao
Hannes

PS: I noticed the statements about the privacy and spam problems and I
recall similar concerns when the Dynamic Delegation Discovery System (DDDS),
see http://www.ietf.org/rfc/rfc3401.txt, was developed. It allows all sorts
of information being stored with an identity in the DNS (with RFC 2916 the
goal was to associate other services to an E.164 number, such as SIP URIs,
email addresses, etc.). When others are able to find out how to contact me
easily then they can obviously use the obtained information to send unwanted
traffic.

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

[Santosh Rajan]

Well that is the motivation. Unfortunately there is more.

If we could map an email like identifier "acct%3Ajoe@..." to

http://example.com/?subject=joe@...

and resolve this into an XRD, then there is no problem. Because the acct: scheme is piggy backing on the http(s) scheme.

Unfortunately when you want to legitimize a new scheme, which is actually dependent on another scheme (http(s)), by subverting the definition of related specs like the XRD spec and host-meta spec, you have a very serious problem in your hands.

On Mon, Nov 2, 2009 at 7:01 AM, Hannes Tschofenig <Hannes.Tschofenig@...> wrote:

Hi all,

I read throught the Webfinger description and I was trying to figure out
what the problem statement is.

I really saw only one aspect discussed in more detail, namely that URIs (as
used in OpenID) are difficult for users to understand. The usage of email
alike addresses (namely those identifiers using username@domain) would be
better.

Sounds reasonable to me.

Is this the motivation or is there more?

Ciao
Hannes

PS: I noticed the statements about the privacy and spam problems and I
recall similar concerns when the Dynamic Delegation Discovery System (DDDS),
see http://www.ietf.org/rfc/rfc3401.txt, was developed. It allows all sorts
of information being stored with an identity in the DNS (with RFC 2916 the
goal was to associate other services to an E.164 number, such as SIP URIs,
email addresses, etc.). When others are able to find out how to contact me
easily then they can obviously use the obtained information to send unwanted
traffic.

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general

--
http://hi.im/santosh

_______________________________________________
general mailing list
general@...
http://lists.openid.net/mailman/listinfo/openid-general