<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Dick,<br><br>> The ad-hoc HTTP header and ad-hoc HTML tag are not needed to solve the<br>> NASCAR problem. By adding code to the browser, you could work with<br>> existing OpenID providers and RPs.<br>> <br>> We did this with Sxipper 4 years ago. Sxipper remembered your OPs,<br>> detected an OpenID login form, and allowed the user to select which OP<br>> to use at the RP. It remembered which OP you had used at that RP last<br>> and put it on top. It detected when you logged into an OP to add it to<br>> the list of OPs available.<br>> <br>> Detecting RP forms and OPs was non-trivial, and some additional HTML<br>> markup would have made it easier and more robust.<br><br>Our approach doesn't use markup for detection. The markup we use is<br>an <idp> element in the RP's login form whose
value is the data<br>associated with the IdP, i.e. the identity provider, a.k.a. OpenID<br>provider, a.k.a. OP, that the user wants to use for this particular<br>transaction. The brower is free to use any method it wants to<br>determine which OP the user wants to use among those recorded in the<br>user's preferences.<br><br>It's not a good idea to detect an OP automatically, as you seem to say<br>Sxipper used to do, whether the OP is detected using a heuristic or<br>using explicit markup in the OP's site. The user may very well use a<br>site that offers an identity provider service, and even have an<br>account at that site, without wanting to use the identity service.<br>For example the user could use Yahoo as an email service provider<br>while using Wordpress as an OpenID provider. It would be wrong to add<br>Yahoo to the list of identity providers just because the user logs in<br>to Yahoo to process its email. In our approach
Yahoo has to offer its<br>identity service to the user, and the user has to accept it explicitly<br>by clicking on a link or button. In response to that click Yahoo<br>downloads identity provider data in an ad-hoc HTTP header, causing the<br>browser to add Yahoo to the list of identity providers in the user's<br>preferences, after asking the user's consent.<br><br>> As I stated before, this does not solve the problem for users without<br>> an enhanced browser. <br><br>As I said before in response to your earlier statement, the relying<br>party can easily detect whether the browser is enhanced or not, and<br>fall back on an ordinary OpenID interface if it isn't.<br><br>Francisco<br><br><div><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york,
times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Dick Hardt <dick.hardt@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> Francisco Corella <fcorella@pomcor.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Markus Sabadello <markus.sabadello@gmail.com>; Chris Messina <chris.messina@gmail.com>; OpenID General <openid-general@lists.openid.net>; Karen Lewison <kplewison@pomcor.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, February 14, 2012 11:29 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [OpenID] One-Click OpenID: A Solution to the NASCAR Problem<br> </font> </div> <br>
<div id="yiv229943769"><div><br><div><div>On Feb 14, 2012, at 11:01 PM, Francisco Corella wrote:</div><blockquote type="cite"><div><div style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);font-family:times, serif;font-size:12pt;">Everybody:<br><br>Before telling me that what I'm proposing has been done before, please<br>read what I'm proposing. </div></div></blockquote><div><br></div>I did. </div><div><br><blockquote type="cite"><div><div style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);font-family:times, serif;font-size:12pt;">The user clicks on the button and is<br>automagically redirected to her preferred OpenID provider, even if the<br>relying party has never heard of it.<br></div></div></blockquote><div><br></div><div>got that the first time, see below</div><br><blockquote type="cite"><div><div style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);font-family:times, serif;font-size:12pt;"><br>Hint: if you
want to criticize this, you could criticize the fact<br>that it requires an ad-hoc HTTP header, and ad-hoc HTML tag, and new<br>browser functionality. </div></div></blockquote><div><br></div><div>The ad-hoc HTTP header and ad-hoc HTML tag are not needed to solve the NASCAR problem. By adding code to the browser, you could work with existing OpenID providers and RPs.</div><div><br></div><div>We did this with Sxipper 4 years ago. Sxipper remembered your OPs, detected an OpenID login form, and allowed the user to select which OP to use at the RP. It remembered which OP you had used at that RP last and put it on top. It detected when you logged into an OP to add it to the list of OPs available.</div><div><br></div><div>Detecting RP forms and OPs was non-trivial, and some additional HTML markup would have made it easier and more robust.</div><div><br></div><div>As I stated before, this does not solve the problem for users without an enhanced
browser. </div><div><br></div><div>-- Dick</div><div><br></div><div><br></div></div></div></div><br><br> </div> </div> </blockquote></div> </div></body></html>