<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Hi Allen,<br><br>> Thanks for sharing! <br>> <br>> One of the appealing aspects of your proposal is that it enables users<br>> to login with an account from any OpenID Provider, as opposed to being<br>> limited to a small set of NASCAR buttons. However, websites generally<br>> limit the choices available to users in order to persuade the user to<br>> login using a high value account with data and services (name,<br>> verified email address, social sharing, profile, Likes, etc).<br>> <br>> In practice, not many websites want to users to login with 3rd party<br>> accounts unless they're guaranteed to get some data/services - it<br>> seems that most sites would rather have the user register a new local<br>> account with a password if the user doesn't want to use one of the<br>> NASCAR
buttons. Account Chooser and Mozilla's BrowserID are both<br>> relatively email-address centric because verified email address seems<br>> to be the bare minimum that sites need to to get in order to justify<br>> accepting a 3rd party login relative to just registering a local<br>> account.<br>> <br>> Does your proposal have a way for an RP to specify the requirements<br>> for accounts that are acceptable for users to login with? For<br>> instance, an RP may only accept OpenIDs from OPs that share the user's<br>> verified email address.<br><br>Yes, the RP can use the SREG extension of OpenID, which does exactly<br>that. See:<br><a href="http://openid.net/specs/openid-simple-registration-extension-1_0.html">http://openid.net/specs/openid-simple-registration-extension-1_0.html</a><br><br>Francisco<br><br></div></body></html>