<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Luke Shepard wrote:
<blockquote cite="mid:C56BF60A.225DF%25lshepard@facebook.com"
type="cite">
<title>Re: [OpenID] FB Connect, OpenID and UX</title>
<font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;"><br>
<br>
For Facebook Connect, the user’s credentials aren’t ever entered into
an iframe. If the user is not logged into Facebook, then they will get
a normal browser popup. I believe browser popups are supported by
OpenID as well:<br>
<br>
<br>
</span></font></blockquote>
<font face="Calibri, Verdana, Helvetica, Arial">There is no safe way to
ask for the user's credentials inline in an iframe/lightbox, however, a
popup is a good compromise. Unfortunately, there is no standard way in
OpenID for the RP to send the authentication request to the OP in a
popup.<br>
<br>
The Connect popup could be improved a bit by using HTTPS, and perhaps
setting the hostname to something a bit shorter and more recognizable,
like <a class="moz-txt-link-freetext" href="https://login.facebook.com">https://login.facebook.com</a> <br>
<br>
Allen<br>
<br>
</font>
</body>
</html>