<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 03/30/2009 12:52 PM, santrajan:
<blockquote cite="mid:22779696.post@talk.nabble.com" type="cite">
<pre wrap="">
Eddy Nigg (StartCom Ltd.) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Why does anyone want to have the email address verified when receiving
an assertion about the authentication from the OpenID provider? This is
beyond me...
</pre>
</blockquote>
<pre wrap="">
Thats exactly the point I am making. If the email does not come with the
assertion about the authentication, a site that needs the email address to
provide a service to the user will not be able to use OpenID.
</pre>
</blockquote>
<br>
Historically the email address confirmation is/was done by site
operators in order to prevent spam comments and make reasonable sure
that it's a real person behind the user. Obviously this was long time
ago exploited by spammers...then site operators added CAPTCHA's in
addition to the email verification...this too has already been
exploited by spammers.<br>
<br>
OpenID provides an assertion that there is a user associated with the
respective ID. If and which hops and jumps a user must undergo before
receiving an account varies from provider to provider. For general
information including email addresses RPs can request them via SREG.
Users may allow the disclosure of the email address (if they think the
site needs it really).<br>
<br>
Having said that, OpenID is subject to be exploited at some point by
(comment) spammers as well. Some providers can be easily exploited and
used for (comment) spamming already today (not to be confused with
email spam). I expect site operators will also realize at some point
which OpenID providers provide a higher value to them than others.<br>
<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>