Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread Breno de Medeiros
I am in full agreement. Indeed, the proposed charter for the WG has always indicated that the deliverable would be a guidance document, not a separate spec. It should be up to the 2.1 authentication WG to later decide if the guidance document should be published as a separate spec, or if instead i

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Recordon
Hey Breno, I think this is a good point and judging from this thread already, there seems to be a group of people really interested in working on discovery for OpenID. If we can frame the working group in the right way (David Fuelling framed it well as "I guess I'm more of the opinion tha

Re: Are the Discovery Components Done Enough?

2009-06-09 Thread David Fuelling
On Tue, Jun 9, 2009 at 9:19 PM, SitG Admin wrote: > There's a significant camp of people that believe this information should >> be included in DNS. There's also a significant group of people who believe >> it could be located an XRD file (or, "on the web"). >> > > What if the discovery document

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Fuelling
Great feedback. I took the liberty to add this to the "Discussion Points" on the wiki page. http://wiki.openid.net/OpenID-Discovery On Tue, Jun 9, 2009 at 8:43 PM, Allen Tom wrote: > My primary concern with changing OpenID Discovery is the upgrade path to > the new discovery mechanism. It took

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Fuelling
My bad -- I errantly thought you were advocating the opposite. On Tue, Jun 9, 2009 at 9:15 PM, Breno de Medeiros wrote: > And I agree with you. My view is that in the absence of an OpenID discovery > WG there will be _more_ uncertainty about future directions for the spec, > not less. > > __

Re: Are the Discovery Components Done Enough?

2009-06-09 Thread SitG Admin
There's a significant camp of people that believe this information should be included in DNS. There's also a significant group of people who believe it could be located an XRD file (or, "on the web"). What if the discovery document says "E-mail this autoresponder address."? Should all discov

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread Breno de Medeiros
And I agree with you. My view is that in the absence of an OpenID discovery WG there will be _more_ uncertainty about future directions for the spec, not less. On Tue, Jun 9, 2009 at 2:13 PM, David Fuelling wrote: > On Tue, Jun 9, 2009 at 7:09 PM, Breno de Medeiros wrote: > >> If we start the pr

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Fuelling
On Tue, Jun 9, 2009 at 7:09 PM, Breno de Medeiros wrote: > If we start the process to form a WG for discovery now, most likely the > process would only be completed in 6 months, even if there was considerable > agreement and stable technologies to draw from. > > Right now, there is quite a bit of

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Fuelling
On Tue, Jun 9, 2009 at 7:00 PM, Santosh Rajan wrote: > > We need to remember that XRD only addreses discovery for URL identifiers. This is not really true. The XRD document schema only demands that an identifier be a URI, both for the XRD document's "subject" (i.e., the canonical-id) and the X

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Fuelling
David, Great questions -- see my thoughts/opinions inline... david On Tue, Jun 9, 2009 at 6:36 PM, David Recordon wrote: > Hey David,I've been following some of the discovery work the past few > months, but don't have a clear picture if the various components are > actually solid enough to beg

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread Allen Tom
My primary concern with changing OpenID Discovery is the upgrade path to the new discovery mechanism. It took way too long for everyone to upgrade to OpenID 2.0, so I'd like to have a better understanding the upgrade path to OpenID 2.1 and/or the new Discovery mechanism. Allen David Recordon

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread Breno de Medeiros
If we start the process to form a WG for discovery now, most likely the process would only be completed in 6 months, even if there was considerable agreement and stable technologies to draw from. Right now, there is quite a bit of momentum and excitement about Webfinger. The XRI TC is hoping to pu

Re: Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread Santosh Rajan
We need to remember that XRD only addreses discovery for URL identifiers. XRD does not address email like identifiers. XRD actually has two properties. 1) generic format for resource descriptor documents (XRD documents) 2) protocol for obtaining XRD documents from HTTP(S) URIs. For email identifie

OpenID SASL mechanism?

2009-06-09 Thread Peter Saint-Andre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 If you are interested in defining a SASL mechanism for OpenID, please let me know. I might want to work on such a beast. :) Peter - -- Peter Saint-Andre https://stpeter.im/ -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.8 (Darwin) Comment: Using

Are the Discovery Components Done Enough? (Fwd: [security] OpenID Security Best Practices Doc)

2009-06-09 Thread David Recordon
Hey David, I've been following some of the discovery work the past few months, but don't have a clear picture if the various components are actually solid enough to begin working with. I know XRD is moving forward, but what's the state of site-meta (http://tools.ietf.org/html/draft-nottingh