<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Rabbit,<div><br></div><div>Unless you're limiting the set of OP's you're willing to work with(quite likely in the future, in my view, but that's not universally shared), I think it will prove necessary to retain the CAPTCHA. It's trivial to generate arbitrary OpenID's for robots, and would certainly happen rapidly if there were more exposed RP's in the world.</div><div><br></div><div>Take care,</div><div>Nate.</div><div><br><div><div>On 26 Mar 2009, at 06:55, Rabbit wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Services rely on OpenID to prove a user is *who* they claim to be. Should services also rely on OpenID to prove a user is *what* they claim to be?<span class="Apple-converted-space"> </span>The cautious would say no but I thought the question was interesting. Should proving to Google that I am a human be good enough for an RP to believe it too? Is there an implied transitive property of trust that comes along with using some services as opposed to others?</font></p> </blockquote></div><br></div></body></html>