<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Peter,<div><div><br class="Apple-interchange-newline"><blockquote type="cite"> <div id="idOWAReplyText38798" dir="ltr"> <div dir="ltr"><font face="Arial" color="#000000" size="2">I think its germane to address the apparently sensitive issue at the heart of the thread: gatewaying, particularly in this highly doctrinal UCI forum.</font></div></div></blockquote><div><br></div><div>I don't think it's relevant because there's a lightweight trust model here. I receive and validate an identifier from this OP. I make a decision how to trust it. I may decide that it's "equivalent" to a Google account, or I may not, but that's totally independent. It'd still be independent if this were a google.com address(all kinds of interesting things happen in *.edu domains).</div><div><br class="webkit-block-placeholder"></div><div>From my brief reading, OpenID doesn't have any formal notions of gateways or proxies in its protocol. If this conversation were in the context of such support or a stronger trust model, we'd have something to talk about, and you hint at that in your last paragraph. </div><div><br class="webkit-block-placeholder"></div><div>Until there are reputation services or federations or something, ultimate access control decisions are solely the SP/RP's to make. It alone must decide how to trust the inputs. There's just nothing else to go by.</div><div><br class="webkit-block-placeholder"></div><div>Hope this makes sense,</div><div>Nate.</div><blockquote type="cite"><div id="idOWAReplyText38798" dir="ltr"><div dir="ltr"><font face="Arial" size="2"></font></div></div></blockquote></div></div></body></html>