[OpenID] Association poisoning

[Martin Atkins]

Andrew Arnott wrote:
> Martin,
> Yes, that about sums it up.  Since thinking of this potential problem I
> couldn't find anywhere in the OpenID 2.0 spec that calls out the caution.
>  If it isn't there, perhaps 2.1 can add it.
> 
> As stated in my blog post, I only checked Janrain's ruby library and
> dotnetopenid.  I haven't checked any other RPs.  I hope that anyone that
> owns an RP implementation will check for this.

I checked the Perl Net::OpenID::Consumer implementation and confirmed 
that it doesn't suffer from this flaw.