<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [OpenID] Yahoo hijacking?</title></head><body>
<div>>if I go to Yahoo for an OpenID login, and then change my mind
and say "I do not want to login", they take me to <a
href="http://www.yahoo.com">www.yahoo.com</a>!!!</div>
<div><br></div>
<div>Side question - if they used CSRF to have you request (via GET)
the appropriate page from the Relying Party, would that be acceptable?
Is it sufficient to have the user notify the RP that nothing further
will be happening, or should the user visit the site normally to
continue further interactions, and at least have the chance to receive
further info directly from the site?</div>
<div><br></div>
<div>I can see malicious RP's saying "You changed your mind? Well
then here's a page full of nasty ActiveX that will try to infect your
machine, have a nice day.", but I can also see a friendly site
saying "Your comment has been preserved, would you like to post
it as 'Anonymous'?" or showing the user a list of features that
they can access if they log in.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>