<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Simon,<br>
<br>
Simon Willison wrote:
<blockquote
cite="mid:a3b4f3b60707151435l4f8873d6m40742d8ccac3566e@mail.gmail.com"
type="cite">
<pre wrap="">
I believe in the concept of whitelists, although at the level of
individual OpenIDs rather than providers:
<a class="moz-txt-link-freetext" href="http://simonwillison.net/2007/Jan/22/whitelisting/">http://simonwillison.net/2007/Jan/22/whitelisting/</a>
</pre>
</blockquote>
Interesting, but it's not what I envision really...But seeing the
various efforts around black/whitelisting shows that there is a real
problem and a real need for a standardized solution! Even you think,
that you have to have some protection ;-)<br>
<blockquote
cite="mid:a3b4f3b60707151435l4f8873d6m40742d8ccac3566e@mail.gmail.com"
type="cite">
<pre wrap="">
More generally, any body that operates a whitelist should (and I
believe must) exist as a separate entity from the core OpenID effort.
</pre>
</blockquote>
I agree, so this effort can grow from within the current OpenID
community. This is what I'm trying to achieve with this discussion. I
imagine that he verifying body/foundation would be staffed by members
from this community, hopefully with some of the core members and
leaders present at the board (or whatever its setup).<br>
<blockquote
cite="mid:a3b4f3b60707151435l4f8873d6m40742d8ccac3566e@mail.gmail.com"
type="cite">
<pre wrap="">OpenID supports this already - if someone wants to set up this effort
right now there's nothing to stop them from doing so, and they can
build it on the existing 1.1 specification. </pre>
</blockquote>
OK, how exactly should this be implemented? <br>
<blockquote
cite="mid:a3b4f3b60707151435l4f8873d6m40742d8ccac3566e@mail.gmail.com"
type="cite">
<pre wrap="">This also maintains
OpenID's decentralised nature - there can be one provider whitelist
effort or many, the spec has nothing to say on the matter.
</pre>
</blockquote>
Errr...I'd like to have a standardized way to hook in a provider
verification lookup or something along this lines...<br>
<blockquote
cite="mid:a3b4f3b60707151435l4f8873d6m40742d8ccac3566e@mail.gmail.com"
type="cite">
<pre wrap="">
Personally, I plan to have my applications accept any and all OpenIDs,
even ones from providers such as <a class="moz-txt-link-abbreviated" href="http://www.jkg.in/openid">www.jkg.in/openid</a> which I know to
allow any user to authenticate any OpenID. If my users wish to give
away their accounts then that's their business.
</pre>
</blockquote>
Sure, I think you'll be free to do that also in the future, but the
other ones preferring some verification level of the IDPs can choose to
use it too...I guess, that this is pretty much along the lines of
OpenIDs goals and nature...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>