Welcome to Geeklog, Anonymous Thursday, July 16 2026 @ 10:05 am EDT

Comments for OpenID pre-announcement

OpenID pre-announcement | 20 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

OpenID pre-announcement

Authored by: jmatt on Tuesday, June 05 2007 @ 10:44 am EDT

Possible bug, detected by LWC who tested my OpenID implementation. LWC used the OpenID URL bugmenot.openid.com (which I suspect is an opportunity for abuse, but I'll let it slide for a while). That Openid does not have an email address associated with it.

I have an openid server set up for my own use. When I log on to a site (including my own Geeklog site) with my openid URL, my Openid server asks me I want to trust that site, and indicates what profile information the site has requested. It tells me that my Geeklog site requests Nickname, Email Address, and Full Name, all of which are required.

But apparently, even though email address is "required", if the Openid Server doesn't provide it, the Geeklog Openid implementation apparently allows the login, and creates a remote userid without the email address. When I look at my list of users, I see the "bugmenot" id with no email address.

OpenID pre-announcement

Authored by: LWC on Tuesday, June 05 2007 @ 01:31 pm EDT

That's a spam site (I suggest some admin deletes it). I used http://bugmenot.myopenid.com (a server which Dirk recommended and it's also the first recommendation in the the list in openid.net).

jmatt offered in his site to reject any user that has the ability to not give out their e-mail address to their server. However, the reality is that even the #1 recommended server, Myopenid, does not require an e-mail address (they actually say it's only needed if you want to receive server notifications. How many people do you think will say "Hooray! Notifications!" and give out their addresses?). This means Geeklog has to accept the fact that this server and probably other mainstream servers do not require an e-mail address.

Therefore, rejecting makes no sense (or you'll just boycott every second server). Somehow Geeklog must face remote users without an e-mail adderss. How, I do not know. Asking them for a local address would hurt the whole purpose, so I hope there's another way out.

You should also know remote users without an e-mail address can't change their Geeklog settings. But most imporantly, Geeklog DOES let other users send them e-mail (which is sent to an empty address)!

OpenID pre-announcement

Authored by: Dirk on Thursday, June 07 2007 @ 07:14 am EDT

Yep, handling of email addresses is one things that have to be addressed. Currently, the rest of Geeklog assumes that all email addresses in the system are unique and valid. So that's why you can (attempt to) send an email to OpenID users without an email address. Similar problems occur with duplicate email addresses (neither of those users can change their preferences).

I was aware of the problem with duplicate addresses but not with empty addresses (although I should have been - typekey.com doesn't send them out and you can't even change that).

Well, that's one of the reasons why we made the patch available: To find issues like this early.

OpenID pre-announcement

Authored by: LWC on Thursday, June 07 2007 @ 12:16 pm EDT

Ok, thanks.

OpenID pre-announcement

Authored by: jmatt on Thursday, June 07 2007 @ 12:35 pm EDT

LWC and I have had some discussion about this on my own site, which can be seen at the trackback link above if anybody is interested. I won't repeat it all, but basically there are a lot of things that can be considered. Some of them may be reasonable and some may not.

I think one obvious step would be to change the Geeklog Openid consumer code to reject any openid login which does not provide an email address. This should be fairly simple to do. Some people might not like the idea of giving their email address to an openid server, and then letting the server give it out to sites that ask for it. I say too bad ... if you want to register on sites that require an email address, you have to be prepared to give it to them. Your openid server gives you control over which sites get your email address (at least mine does), so as long as you trust your openid server to do what it says, this shouldn't be an issue. If you don't want to give your email address to a site that requires it, don't register on that site.

Of course, just because an openid request includes an email address, that doesn't necessarily mean it's a good address. Somebody could get around the requirement by sticking in a dummy address. I suppose the Geeklog code could do some simple checking (is it syntactically valid, does the domain exist, does it have a responding SMTP server, etc.), but to really make sure that it's a legitimate address that belongs to the requester probably requires some sort of confirmation message. And I don't know how easy that is to add. The current system for local users has built-in confirmation, since the user has to use the password emailed to him. If he doesn't provide a good address, he doesn't get the password. Obviously that doesn't work for openid users, who don't need a password. There could be some system for emailing a confirmation code that would be required for the first login, but that might get too complicated.

I should correct one minor error in one of my previous comments. I got a little sloppy. I said that LWC had used the id bugmenot.openid.com on my site, and he said that wasn't him because he used bugmenot.myopenid.com. In fact, I just mistyped the address. There is only one bugmenot registered on my site, and it is bugmenot.myopenid.com. I haven't (yet) been hit by a spammer with an openid login.

Speaking of spammers, I am seeing a lot of log messages like:

Unable to find an OpenID server for the identity URL <spam link deleted>

I don't think the spammers are really trying to use openid, because the URLs don't look like more like normal spam links than real Openid URLs. (I couldn't post a real example because spamx rejected my post with the spam link in it), and I realize that theoretically, any valid URL could be an Openid, but I'm pretty sure these aren't).

I think they're just sticking their URLs into anything that looks like a place to submit a URL hoping it will show up somewhere.

OpenID pre-announcement

Authored by: Dirk on Thursday, June 07 2007 @ 01:35 pm EDT

I'm also beginning to think that we should be rejecting logins without an email address. The only thing that's holding me back is that we will effectively be blocking services that simply don't provide that information, e.g. typekey.com. Other services, like myopenid.com, handle that much better in that they let you chose between different personalities. So if you don't want to hand out your "good" email address, you could use a personality with one that's only a spamtrap.

As for OpenID spam: That has already happened. The ones you saw, though, are only stupid spambots that simply fill out every form they find. I got one of those within minutes when I first tried out the patch on a public website ...

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks