<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I like how MySpace says this on their login screen:<br>
<br>
<h3>Always make sure you're visiting the real myspace.com!</h3>
<ol>
<li>Check the URL in your browser.</li>
<li>Make sure it begins with <a class="moz-txt-link-freetext" href="http://www.myspace.com/">http://www.myspace.com/</a></li>
<li>If ANY OTHER PAGE asks for your info, DON'T LOG IN!</li>
</ol>
<br>
<br>
<br>
<br>
oseph A Holsten wrote:
<blockquote
cite="mid:4CBE247E-009D-49F1-8B81-F8528FF209AF@josephholsten.com"
type="cite">Agreed. It is vital that, in the absence of ibid, the user
check the OP url. A warning of that sort would have to go on the RP's
page of the flow. But the RP is probably the one trying to spoof the
user.
<br>
<br>
I think the best tactic is then to get respectable RPs to mention it so
checking becomes second nature. Has anyone put together a really
effective blurb to tell users how to check the URL? How about a box
like <a class="moz-txt-link-freetext" href="http://www.flickr.com/photos/josephholsten/3107919243/">http://www.flickr.com/photos/josephholsten/3107919243/</a><br>
<br>
<hr size="4" width="90%"><br>
<center><img src="cid:part1.02090103.05020400@yahoo-inc.com"></center>
<p><br>
<br>
<a class="moz-txt-link-freetext" href="http://josephholsten.com">http://josephholsten.com</a>
<br>
<br>
<br>
On Dec 14, 2008, at 3:05 PM, David Fuelling wrote:
<br>
<br>
</p>
<blockquote type="cite">Hi Sebastian,
<br>
<br>
I love your mockups! Great ideas!
<br>
<br>
The only flaw is the whole "password" bit, though I think this is a
flaw with Facebook's solutions as well. For people that use Facebook a
lot, and also start connecting to other websites using Facebook
Connect, the potential for phishing seems very high -- If I'm not
already logged-in to my Facebook account, and I try to "Connect" using
Facebook, I'm asked for my Facebook email address/password. This is
not good. In the future, once Facebook Connect becomes very familiar
to people, it will be easy to phish this type of thing (on my popup
window for facebook, the URL is
<a class="moz-txt-link-rfc2396E" href="http://www.connect.facebook.com/lo...">"http://www.connect.facebook.com/lo..."</a>, the rest of which is cut-off).
Most people won't bother to look and see what the rest of the URL says
(it could be <a class="moz-txt-link-freetext" href="http://www.connect.facebook.com.lookout.com">http://www.connect.facebook.com.lookout.com</a>").
<br>
<br>
I think your UI workflow will have the same problems as Facebook
Connect. So, is there a way to utliize the workflow you propose, but if
the user isn't logged-in to their OP, then take them to their OP's
login page
<br>
(which would involve a redirect). I know it's not an ideal "flow", but
my feeling
<br>
is that Facebook's connect popup (or Open Connect's popup) will be
easily phishable in its current form that asks for a password to be
entered.
<br>
<br>
Overall, though, I think your flow is pretty cool!
<br>
<br>
David
<br>
<br>
On Sun, Dec 14, 2008 at 5:46 PM, Sebastian <a class="moz-txt-link-rfc2396E" href="mailto:pixelsebi@me.com"><pixelsebi@me.com></a>
wrote:
<br>
Hi UX list,
<br>
<br>
I have created a few mockups over the weekend to illustrate a UX
<br>
proposal, which just adapts the Facebook Connect design-pattern for
<br>
the OpenStack:
<br>
<br>
<a class="moz-txt-link-freetext" href="http://pixelsebi.com/2008-12-14/open-connect-a-ux-proposal-for-the-openstack/">http://pixelsebi.com/2008-12-14/open-connect-a-ux-proposal-for-the-openstack/</a>
<br>
<br>
Looking forward to get your feedback!
<br>
<br>
Best Regards,
<br>
Sebastian
<br>
<br>
_______________________________________________
<br>
user-experience mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:user-experience@openid.net">user-experience@openid.net</a>
<br>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/user-experience">http://openid.net/mailman/listinfo/user-experience</a>
<br>
<br>
_______________________________________________
<br>
user-experience mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:user-experience@openid.net">user-experience@openid.net</a>
<br>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/user-experience">http://openid.net/mailman/listinfo/user-experience</a>
<br>
</blockquote>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
user-experience mailing list
<a class="moz-txt-link-abbreviated" href="mailto:user-experience@openid.net">user-experience@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/user-experience">http://openid.net/mailman/listinfo/user-experience</a>
</pre>
</blockquote>
<br>
</body>
</html>