<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><BR><DIV><DIV>On 15-Sep-07, at 8:25 PM, Johannes Ernst wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><BR><DIV><DIV>On Sep 14, 2007, at 16:00, John Panzer wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"> Johannes Ernst wrote: <BLOCKQUOTE cite="midC4650EDC-228E-4F99-A473-79E4E8527353@netmesh.us" type="cite">I'm one of the guys who actually maintains an ACL (Access Control List) based on OpenID identities. The process works like this: <BR> - Customer: hey, I'd like access to your website <BR> - Me: sure, send me your OpenID <BR> - Customer: foo.bar.com <BR> - Me: adding <A class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</A> to the ACL <BR> - Customer: hey, I tried but it doesn't work <BR> - Me (diagnosing): that's because you entered '<A class="moz-txt-link-freetext" href="https://foo.bar.com/">https://foo.bar.com/</A>' and not '<A class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</A>". <BR> <BR> This happens in a surprisingly large number of cases. <BR> <BR> No user seems to put any significance into the http vs. https as part of their identifier; even the people who do have the technical understanding to distinguish the two tend to fail understanding that within this community, we treat them as different identities. <BR> </BLOCKQUOTE> I think that treating these as different identities would be a fairly major potential impersonation security problem.<BR></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV>Exactly my point. This should be part of the spec.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Editors, anybody?</DIV></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I don't have a good answer, all the ones that come to mind are ugly and have some issue.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>-- Dick</DIV><BR></DIV><BR></BODY></HTML>