Yes, I agree that the scope should be more symmetrical. For instance, RPs might advertise support for popup if they want to accept unsolicited assertions. As for the language, however, I see no need to duplicate functionality available via AX/SRGE (at least not without a good argument).<br>
<br><div class="gmail_quote">On Fri, Mar 20, 2009 at 12:07 PM, Paul Madsen <span dir="ltr"><<a href="mailto:paulmadsen@rogers.com">paulmadsen@rogers.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
Thanks Breno, the point I was trying to make was that, as I read it,
the WG proposed scope allows for<br>
<br>
a) how the OP will advertise support for pop-up UI<br>
b) how the RP sends the hint as to language <br>
<br>
But not the other 'corners', i.e that also in scope is how the RP sends
the UI hint or how the OP advertises support for different languages<br>
<br>
It just seems asymmetrical.<br><font color="#888888">
<br>
paul</font><div><div></div><div class="h5"><br>
<br>
Breno de Medeiros wrote:
<blockquote type="cite"><br>
<br>
<div class="gmail_quote">On Fri, Mar 20, 2009 at 11:14 AM, Paul
Madsen <span dir="ltr"><<a href="mailto:paulmadsen@rogers.com" target="_blank">paulmadsen@rogers.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">Thanks Allen, could you
clarify something for me please? You describe
the two aspects of the extension (language and pop-up) both as hints
from the RP to the OP - these guiding the OP in building UI for the
user.<br>
<br>
But the scope section of the WG proposal indicates that it is the OP
that indicates to the RP its support for a pop-up UI, rather than the
RP hinting/requesting that the OP build such a UI .....</div>
</blockquote>
<div><br>
As in other OpenID extensions, the OP indicates in its discovery
document support for these features. RPs automatically discovery that
the features are available and take advantage of them by sending hints
to the OP in requests.<br>
<br>
The RP needs to know in advance that the OP supports popup UIs
otherwise sending the request in a popup may result in suboptimal
experience because the rendered UI is oversized.<br>
<br>
</div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000"><br>
<br>
Am I missing something?<br>
<br>
paul<br>
<br>
Allen Tom wrote:
<blockquote type="cite">
<div>
<div> Hi Paul,<br>
<br>
What the OP decides to display within the Popup is out of scope,
consistent with how the content the OP displays in the current redirect
UI is out of scope. The OpenID spec does not define the method used to
authenticate the user, so some OPs may use username/password, and
others might use other authentication techniques. As Breno mentioned
earlier, the popup is really not much different than the existing UI,
except that it's in a popup.<br>
<br>
I believe that that it is very prudent for OPs to educate their users
about phishing and security in general, and the text currently on
MySpace's homepage is a good example.<br>
<br>
The language hint and the popup UI are related in that they are both UI
attributes passed by the RP to the OP so that the OP can display an
authentication UI that is optimized for the RP's user experience. We
intend that the resulting UI Extension will allow the language
preference and popup to be implemented independently of each other. We
expect that OPs can advertise support for either language preference,
popup, or both via discovery.<br>
<br>
Thanks<br>
Allen<br>
<br>
<br>
<br>
<br>
Paul Madsen wrote:
<blockquote type="cite"> Allen, would not the fact that the
content of the pop-up is
specifically declared out of scope in the WG proposal preclude guiding
the OP to provide such warnings or, for instance, display a sign-in
seal, in the pop-up ?<br>
<br>
Separately, a language hint from the RP is clearly orthogonal to the
question of pop-up/full window. Are there implications for them to be
conflated into a single extension, e.g. for metadata advertisement of
extension support?<br>
<br>
paul<br>
<br>
Allen Tom wrote:
<blockquote type="cite"> The popup window will be REQUIRED to
display the address bar. OPs will
be strongly encouraged to educate their users to always pay attention
to the URL of the address bar before entering their credentials.<br>
<br>
In particular, I think MySpace does an excellent job on their home page:<br>
<br>
<h3>Always make sure you're visiting the real <a href="http://myspace.com" target="_blank">myspace.com</a>!</h3>
<ol>
<li>Check the URL in your browser.</li>
<li>Make sure it begins with <a href="http://www.myspace.com/" target="_blank">http://www.myspace.com/</a></li>
<li>If ANY OTHER PAGE asks for your info, DON'T LOG IN!</li>
</ol>
Allen<br>
<br>
<br>
SitG Admin wrote:
<blockquote type="cite">
<blockquote type="cite">Phishing still is a major concern,
however,
we do not think that the popup window significantly changes the
phishing scenarios compared to the existing full browser window UIs
today. <br>
</blockquote>
<br>
Are you speaking of full-size windows, here, or windows that have an
address bar in them? Pop-up windows that are missing this indication of
what site the user is at may reduce confusion by eliminating
distractions, but they also take away from the user's awareness of
what's going on. <br>
<br>
-Shade <br>
</blockquote>
<br>
<pre><hr size="4" width="90%">
_______________________________________________
general mailing list
<a href="mailto:general@openid.net" target="_blank">general@openid.net</a>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a>
</pre>
<pre><hr size="4" width="90%">
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.557 / Virus Database: 270.11.19/2011 - Release Date: 19/03/2009 7:05 AM
</pre>
</blockquote>
<br>
<div>-- <br>
<font size="-1">Paul Madsen<br>
e:paulmadsen @ <a href="http://ntt-at.com" target="_blank">ntt-at.com</a><br>
p:613-482-0432<br>
m:613-282-8647<br>
web:<a href="http://connectid.blogspot.com" target="_blank">connectid.blogspot.com</a><br>
</font><a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1" target="_blank"><img src="cid:part1.00020407.05020406@rogers.com" alt="ConnectID" style="border: 0pt none ;"></a></div>
</blockquote>
<br>
</div>
</div>
<pre><hr size="4" width="90%">
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.557 / Virus Database: 270.11.21/2014 - Release Date: 20/03/2009 6:59 AM
</pre>
</blockquote>
<div><br>
<div>-- <br>
<font size="-1">Paul Madsen<br>
e:paulmadsen @ <a href="http://ntt-at.com" target="_blank">ntt-at.com</a><br>
p:613-482-0432<br>
m:613-282-8647<br>
web:<a href="http://connectid.blogspot.com" target="_blank">connectid.blogspot.com</a><br>
</font><a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1" target="_blank"><img src="cid:part2.02070409.05080801@rogers.com" alt="ConnectID" style="border: 0pt none ;"></a></div>
</div>
</div>
<br>
_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@openid.net" target="_blank">general@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
--Breno<br>
<br>
+1 (650) 214-1007 desk<br>
+1 (408) 212-0135 (Grand Central)<br>
MTV-41-3 : 383-A <br>
PST (GMT-8) / PDT(GMT-7)<br>
<pre><hr size="4" width="90%">
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.557 / Virus Database: 270.11.21/2014 - Release Date: 20/03/2009 6:59 AM
</pre>
</blockquote>
<br>
<div>-- <br>
<font size="-1">Paul Madsen<br>
e:paulmadsen @ <a href="http://ntt-at.com" target="_blank">ntt-at.com</a><br>
p:613-482-0432<br>
m:613-282-8647<br>
web:<a href="http://connectid.blogspot.com" target="_blank">connectid.blogspot.com</a><br>
</font><a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1" target="_blank"><img src="cid:part3.04010309.07080104@rogers.com" alt="ConnectID" style="border: 0pt none ;"></a></div>
</div></div></div>
</blockquote></div><br><br clear="all"><br>-- <br>--Breno<br><br>+1 (650) 214-1007 desk<br>+1 (408) 212-0135 (Grand Central)<br>MTV-41-3 : 383-A <br>PST (GMT-8) / PDT(GMT-7)<br>