On Mon, Oct 27, 2008 at 4:30 PM, George Fletcher <span dir="ltr"><<a href="mailto:gffletch@aol.com">gffletch@aol.com</a>></span> wrote:<br>>> Once you've got a discovery mechanism for email, you can do OpenID<br>
>> Authentication on email addresses. At that point -- assuming you're<br>>> willing to trust the domain in question -- you have in-band email<div class="Ih2E3d">>> address verification.</div><div class="gmail_quote">
<div class="Ih2E3d">>Yes, this is the expectation. The only difference with this an EAUT is</div><div>> that EAUT allows the resulting OpenID to not be owned by the email</div><div>> domain provider. In the case of "email verification" this additional</div>
<div>> level of indirection isn't really valuable.<br></div></div><br>Sounds like you're saying EAUT can't be used to do email verification. <br>I wrote a blog entry on how it very much can. See here for more details: <a href="http://softwareblog.sappenin.com/2008/10/automatic-email-address-control.html">http://softwareblog.sappenin.com/2008/10/automatic-email-address-control.html</a><br>