<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [OpenID] OpenID Discovery for Email like
identifiers -</title></head><body>
<div>>I log in with <a
href="mailto:andrew@myemail.com">andrew@myemail.com</a>, the RP sends
an email to that address with a special subject line.</div>
<div><br></div>
<div>It would need to be a sufficiently random subject line,
otherwise, I'd take advantage of network lag to discover your XRD file
myself, and then spoof the response back immediately after requesting
a verification from the RP.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>