[OpenID] FW: PROPOSAL: An Extension to transform an EMail Address to an OpenId URL

[David Fuelling]

> -----Original Message-----
> From: Robert Yates [mailto:robyates70 at gmail.com]
>
> 2) Why map the e-mail address to an openid url, which then has to be
> further resolved to a Yadis document?  Why not, instead, map straight
> to a yadis doc and make e-mails full fledged openids.  An openid is
> nothing more than a URI that can be resolved to a Yadis doc.
> mailto:robyates70 at gmail.com is a perfectly valid URI and you have
> demonstrated a pretty simple way to map it to a yadis doc.

This is definitely worth considering.  As you know, the extension I have
proposed is highly controversial.  Past objections (i.e., arguments in favor
of *not* using an email in lieu of an OpenId) are numerous -- see my wiki
compilation for more details there [1].

To be fair, some of these objections are quite valid, which is why I decided
to propose a "mapping" from Email Address to URL, as opposed to making Email
Addresses a first class citizen of OpenId.

Chief among these is that it would be nice if this extension could be used
in systems outside of OpenId.  Mainly, Yadis is required to map an email
address to a URL per my extension.

In addition, URL-centric identity is something that I consider to be very
cool and very important -- it's a key piece of Identity 2.0, and not
something I want to abandon.  Thus, I decided to create a "mapping"
proposal, rather than simply something that says, "Openid should embrace
email addresses." 

THIS is because (If I understand things correctly) email-addresses can be
normalized to URI's (mailto:beth at example.com) in a standard fashion, but
that's not the same thing as a URL (URL's are URI's, but not vice-versa).

Thus, without some kind of mapping to URL, it would probably be unwise to
utilize email addresses as OpenIds.

All that said, you are correct that my mapping proposal does present a way
to get a URL from an email address, so maybe I am just adding an
(unnecessary) extra Yadis call into the mix.  However, I still think that an
extension which makes Email Addresses into OpenId Identifiers would *feel*
different from the extension I proposed, which simply maps an email to a
valid OpenId URL.

It's a subtle difference, and one that I think has often been misunderstood
on the mailing lists.  One is a mapping, which says "you can use an email
address at an RP".  The other, which just doesn't feel right to me, says
that an email *IS* your Identity Identifier, which is tough to swallow.

In reality, I'm not sure if this is just something I *feel*, or if there is
a legitimate technical difference between the two.  I think that they are
technically the same, but the latter notion implies something
philosophically about Identity 2.0 that perhaps should not be implied.

I'd appreciate more feedback from the community on this point before I could
endorse making Emails first-class OpenId citizens (although my proposal
essentially does this via "mapping" sleight of hand).

What do you think?

Thanks!

David

[1] http://openid.net/wiki/index.php?title=Debating_Emails_as_OpenIds