<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I was entertaining the idea of dynamic behavior based on trust or some model for reputation rather than outright limiting. For example, and RP could choose to require a Captcha for any OP other than a small set of providers the RP believes has done an adequate job at eliminating bots.</div><div><br></div><div>=Rabbit</div><br><div><div>On Mar 26, 2009, at 3:19 AM, Nate Klingenstein wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "> Rabbit,<div><br></div><div>Unless you're limiting the set of OP's you're willing to work with(quite likely in the future, in my view, but that's not universally shared), I think it will prove necessary to retain the CAPTCHA. It's trivial to generate arbitrary OpenID's for robots, and would certainly happen rapidly if there were more exposed RP's in the world.</div><div><br></div><div>Take care,</div><div>Nate.</div><div><br><div><div>On 26 Mar 2009, at 06:55, Rabbit wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Services rely on OpenID to prove a user is *who* they claim to be. Should services also rely on OpenID to prove a user is *what* they claim to be?<span class="Apple-converted-space"> </span>The cautious would say no but I thought the question was interesting. Should proving to Google that I am a human be good enough for an RP to believe it too? Is there an implied transitive property of trust that comes along with using some services as opposed to others?</font></div> </blockquote></div><br></div></div></blockquote></div><br></body></html>