Welcome to Geeklog, Anonymous Sunday, January 19 2025 @ 03:53 pm EST

Comments for OpenID pre-announcement

OpenID pre-announcement | 20 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

OpenID pre-announcement

Authored by: Dirk on Thursday, June 07 2007 @ 07:14 am EDT

Yep, handling of email addresses is one things that have to be addressed. Currently, the rest of Geeklog assumes that all email addresses in the system are unique and valid. So that's why you can (attempt to) send an email to OpenID users without an email address. Similar problems occur with duplicate email addresses (neither of those users can change their preferences).

I was aware of the problem with duplicate addresses but not with empty addresses (although I should have been - typekey.com doesn't send them out and you can't even change that).

Well, that's one of the reasons why we made the patch available: To find issues like this early.

OpenID pre-announcement

Authored by: LWC on Thursday, June 07 2007 @ 12:16 pm EDT

Ok, thanks.

OpenID pre-announcement

Authored by: jmatt on Thursday, June 07 2007 @ 12:35 pm EDT

LWC and I have had some discussion about this on my own site, which can be seen at the trackback link above if anybody is interested. I won't repeat it all, but basically there are a lot of things that can be considered. Some of them may be reasonable and some may not.

I think one obvious step would be to change the Geeklog Openid consumer code to reject any openid login which does not provide an email address. This should be fairly simple to do. Some people might not like the idea of giving their email address to an openid server, and then letting the server give it out to sites that ask for it. I say too bad ... if you want to register on sites that require an email address, you have to be prepared to give it to them. Your openid server gives you control over which sites get your email address (at least mine does), so as long as you trust your openid server to do what it says, this shouldn't be an issue. If you don't want to give your email address to a site that requires it, don't register on that site.

Of course, just because an openid request includes an email address, that doesn't necessarily mean it's a good address. Somebody could get around the requirement by sticking in a dummy address. I suppose the Geeklog code could do some simple checking (is it syntactically valid, does the domain exist, does it have a responding SMTP server, etc.), but to really make sure that it's a legitimate address that belongs to the requester probably requires some sort of confirmation message. And I don't know how easy that is to add. The current system for local users has built-in confirmation, since the user has to use the password emailed to him. If he doesn't provide a good address, he doesn't get the password. Obviously that doesn't work for openid users, who don't need a password. There could be some system for emailing a confirmation code that would be required for the first login, but that might get too complicated.

I should correct one minor error in one of my previous comments. I got a little sloppy. I said that LWC had used the id bugmenot.openid.com on my site, and he said that wasn't him because he used bugmenot.myopenid.com. In fact, I just mistyped the address. There is only one bugmenot registered on my site, and it is bugmenot.myopenid.com. I haven't (yet) been hit by a spammer with an openid login.

Speaking of spammers, I am seeing a lot of log messages like:

Unable to find an OpenID server for the identity URL <spam link deleted>

I don't think the spammers are really trying to use openid, because the URLs don't look like more like normal spam links than real Openid URLs. (I couldn't post a real example because spamx rejected my post with the spam link in it), and I realize that theoretically, any valid URL could be an Openid, but I'm pretty sure these aren't).

I think they're just sticking their URLs into anything that looks like a place to submit a URL hoping it will show up somewhere.

OpenID pre-announcement

Authored by: Dirk on Thursday, June 07 2007 @ 01:35 pm EDT

I'm also beginning to think that we should be rejecting logins without an email address. The only thing that's holding me back is that we will effectively be blocking services that simply don't provide that information, e.g. typekey.com. Other services, like myopenid.com, handle that much better in that they let you chose between different personalities. So if you don't want to hand out your "good" email address, you could use a personality with one that's only a spamtrap.

As for OpenID spam: That has already happened. The ones you saw, though, are only stupid spambots that simply fill out every form they find. I got one of those within minutes when I first tried out the patch on a public website ...

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks