Welcome to Geeklog, Anonymous Sunday, June 04 2023 @ 03:55 pm EDT

Comments for OpenID pre-announcement

OpenID pre-announcement | 20 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

OpenID pre-announcement

Authored by: jmatt on Tuesday, May 29 2007 @ 02:03 pm EDT

I'm glad to see this, since I was one of the requesters. I'll probably implement the patch in the near future.

Concerning the trust and spam issues, it might be nice if future releases have some kind of flag to distinguish OpenId users from local Geeklog users. For example, I'm currently using captcha on my site for comments, contact, etc. I don't require captcha for logged-on users. This has been a pretty effective spam blocker. Combined with the other spam protection, I'm getting zero spam.

If spammers figure out they just need to set up an OpenID for their spambots to get around my captcha, I might have to start requiring captcha for logged on users. That's really not a terrible inconvenience, but it might be nice if there was an option to trust OpenID users a little less than local users.

OpenID pre-announcement

Authored by: jmatt on Tuesday, May 29 2007 @ 02:38 pm EDT

After I thought about this a little more, I think it might be simpler, and almost as effective (at least for my purposes), to provide an option to require OpenID users to enter a captcha when they log on, and then trust them like regular users.

OpenID pre-announcement

Authored by: Dirk on Tuesday, May 29 2007 @ 03:00 pm EDT

Remote users of any kind get the service name appended to their username, e.g. Dirk@openid. Well, at least in theory - it may not be fully working everywhere just yet.

And they are all in the "Remote Users" group, which should help restrict their access in some places. And of course you can always ban remote users.

OpenID pre-announcement

Authored by: jmatt on Saturday, June 02 2007 @ 12:21 am EDT

OK, I understand a little better now that I've actually installed it. It's cool! I didn't realize openid logon would actually create a userid in the database. I incorrectly assumed it would just be some kind of dynamic pseudo-user.

I still have a potential spam issue. With my current setup, I require anonymous users to be captcha tested to email, comment, etc. I don't require it for logged-in users, because they get captcha tested when they register. One captcha test is enough.

But openid users don't have to pass the captcha test to logon, even the first time when their userid gets created. So a spambot with an openid could bombard me. I realize I could ban or delete the userid (which I didn't realize earlier), but that still gives them an opportunity to do a lot of damage before I catch them. Prevention is better.

So, if I'm going to allow openid login, it looks like I need to require all users to pass the captcha test to do anything that might be abused by a spammer. That's a minor pain, but I can live with it. It would be a little more convenient if there was a way for openid users to get captcha tested the first time they login, or to change the captcha testing options to provide an option to require it for anonymous and remote users.

OpenID pre-announcement

Authored by: mevans on Sunday, June 03 2007 @ 01:08 am EDT

I'm working on CAPTCHA v3.0 and I will try to get OpenID support in there. My plan is to make it an option just like anonymous, so you can select to have all OpenID users enter the CAPTCHA if you want. The other big change in v3 will be removing the PHP sessions and replacing it with a db driven solution. PHP sessions seem to cause more problems than they solve right now.

Mark

---
gl Labs - extending Geeklog through plugins - www.gllabs.org

OpenID pre-announcement

Authored by: LWC on Tuesday, June 05 2007 @ 08:41 am EDT

Thanks! Don't forget the other types of remote users.

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks