[OpenID] Anonymous, meaningless?

SitG Admin sysadmin at shadowsinthegarden.com
Thu Sep 4 01:06:51 UTC 2008


>What you're attempting in heuristically finding anonymous claimed 
>ids is definitely interesting and in OpenID 1.x probably would have 
>worked really well.  I can't right now think of how to carry it over 
>into 2.0 meaningfully though. :(

Maybe by asking OP's that implement such a feature to add another 
openid string to all those passed saying "This is a real ID." when 
they are and "This ID is anonymous." when they aren't?

Even for those not sharing my approach to pre-emptive access control 
(which OpenID works very well for, since you can know someone's 
"username" without needing to worry about that person setting up a 
password or someone else rushing in and setting up that account 
first), it may be useful for easier Identity management (local to the 
Relying Party's server). I've been thinking that, for those who don't 
have an OpenID yet, I can still offer them access (just read, no 
write) to a small number of pages, and suggest they use the 
www.jkg.in/openid/everyone URI for it, consolidating what could 
potentially be enough newly created anonymous URI's to eat up all my 
server's HD space into a single URI that's used by "everyone". MUCH 
easier to search the databases when there are fewer entries, too. It 
would also be nice to give them a "testing" OpenID that would walk 
them through the process and explain what was (and wasn't) happening 
as they authenticated - educating them about OpenID.

Unfortunately my ability to come up with ideas like this easily 
outstrips my ability to actually implement them ;)

-Shade, still toiling away on code for basic functionality



More information about the general mailing list