Microid mailing list

["Chris Roos" <chrisjroos AT gmail.com>]

On 12/7/06, Peter Saint-Andre <stpeter AT jabber.org> wrote:
> Evan Prodromou wrote:
> > On Wed, 2006-06-12 at 10:33 -0700, Peter Saint-Andre wrote:
> >
> >> But how do we know programmatically when we create the microid that a
> >> given URL is an OpenID?
> >
> > You mean, how do we know that the first string that we're putting into
> > the hash is an OpenID? Probably because the user said, "here is my
> > OpenID", and maybe they validated it using the OpenID protocol. Or maybe
> > we got it out of our database from the user_openid table.
> >
> > The big question is: why would we care what it is? As far as the microid
> > format is concerned, it's just a string.
> >
> > For the publisher of the resource, they can add a microid <meta> tag for
> > each ID they have for the user (email, OpenID, whatever).
>
> I agree. So why do this?
>
>    ... content='openid:sha256:foo' ...
>
> If it's really opaque, why do we specify that it's an openid or an
> i-name or anything else? Just hand over the microid and the other end
> can figure out what it is (if it even cares, which I doubt).

Agreed.  The verifier will already have to have an existing
relationship (email, openid or more that I can't think of - are there
any?) with the user.  They can therefore just try each one in turn.

Chris