<br><br><div><span class="gmail_quote">On 6/11/07, <b class="gmail_sendername">Josh Hoyt</b> <<a href="mailto:josh@janrain.com">josh@janrain.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On 6/8/07, David Fuelling <<a href="mailto:sappenin@gmail.com">sappenin@gmail.com</a>> wrote:<br>> If in 50 years, a given canonical URL domain goes away, then couldn't a<br>> given OpenId URL owner simply specify a new Canonical URL in his XRDS doc?
<br><br>If I understand the way that David Recordon and Drummond are proposing<br>that canonical identifiers work, this is not the case. The canonical<br>identifier is the sole database key, and the URL that the user enters
<br>and everyone sees is reassignable and (to a certain extent) ephemeral.<br>Control of the canonical identifier is necessary and sufficient to<br>assert one's identity.</blockquote><div><br>Yes, I think that's what is intended. However, there doesn't appear to be any mechanism (aside from the proposal "saying so") to enforce that the canonical identifier is the root key. Seems like somebody could arbitrarily switch their canonical id to a different canonical id, so long as the person doing the switching controls a regular OpenID and its XRDS file that specifies the canonical id. Am I missing something there?
<br><br></div></div>