[OpenID] Google OpenID IDP is now live

[Steven Livingstone-Perez]

Yeah, it was the latter, but I know there are cases where it doesn't work. I
guess I was thinking of some solution that could work in many cases (if
someone comes up with something easy that works in all cases then I'd go
with that).

Yes, the privacy issue is the main one that screams out at me.

The question is whether you think you gain anything from knowing this.
Perhaps you do and it's a screwed up solution. I wouldn't mind, perhaps many
would.

-----Original Message-----
From: Martin Atkins [mailto:mart at degeneration.co.uk] 
Sent: 29 October 2008 20:25
To: Steven Livingstone-Perez
Cc: 'Eric Sachs'; 'OpenID List'
Subject: Re: [OpenID] Google OpenID IDP is now live

Steven Livingstone-Perez wrote:
> Still struggling to understand why a language hint at the OP based on 
> the provided OpenID wouldn't work. I mean, if you registered and set a 
> language when doing so then why not use that even when NOT logged in? 
> Only the OP needs to know right?
> 

I'm not sure what exactly you're proposing at the technical level, but I 
can think of two ways to achieve what you're describing:

  * The OP sets a cookie for the user's primary language which persists 
when signed out. This would of course fail if the user is not on a 
computer he's logged in with before, which is unfortunately also the 
most likely case where Accept-Language and similar techniques will fail, 
since the user is most probably not using his own computer and may thus 
be using someone else's settings.

  * The OP looks at openid.identity in the request and picks a language 
based on that. This doesn't work in the directed identity case, where 
the user just enters the OP identifier rather than his own identifier. 
It could also be considered a privacy issue if anyone can discover a 
user's primary language given their OpenID identifier by simply 
initiating OpenID Authentication and seeing what language is returned at 
the OP.

Did you have something else in mind?