<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Dick,</div><div><br></div><div><blockquote type="cite"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 10px; "><font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Anyway, I don't see anything wrong with obtaining an OpenID identifier in our use cases. It just isn't itself meaningful for these apps without the OP being trusted, and often trusted in a specific way. The same is true of any attributes sent too. It's all down to the RP to decide if it cares or not; I don't see an identifier itself as materially different from any other information about the user on this basis, and I think it could be used as a user's primary key just fine for apps that need that.</font></div></blockquote><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">I would argue that you are trying to use an OpenID identifier in a use case that it was not designed to be used.</font></div></blockquote><br></div><div><div>I'm a confused why you would see a strong semantic distinction between the identifier presented by an OP and a set of attributes presented by the same OP in the same transaction. In fact, short of stating that an OpenID identifier is not trustworthy by definition, I'm not sure how it's even possible. If it's dirty, how can the resulting attributes be clean? What would you use as an identifier in the application instead?</div><div><br></div><div>Still not feeling it...</div><div>Nate.</div></div></body></html>