[OpenID] Directed Identity vs. "what the user typed"

[SitG Admin]

>By the way, the "user at password:" portion is not permitted in an 
>http: URL per the specification.

I think the idea was to use "username:password@", an old IE 
convention for pre-loading the username and password to use if 
prompted for authentication. This feature was eventually removed, 
despite the convenience it added (bookmarkable "password entered" 
sites), for security reasons: phishers were sending users to 
"http://www.google.com@www.phisher.com/" and getting away with it 
because users weren't paying much attention beyond seeing 
"google.com".

-Shade