<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><BR><DIV><DIV>On 23 Jan '06, at 5:15 PM, Kevin Turner wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">There's a pretty straightforward way to address this concern.<SPAN class="Apple-converted-space"> </SPAN>If you</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">don't believe the code that generates your dynamic web page is</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">trustworthy enough for your identity, don't use it.<SPAN class="Apple-converted-space"> </SPAN>Instead of putting</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">your identity URL at <A href="http://mooseyard.com/Jens/">http://mooseyard.com/Jens/</A> , why not</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana"><A href="http://mooseyard.com/o">http://mooseyard.com/o</A> , where "o" is a static page?<SPAN class="Apple-converted-space"> </SPAN>Personally, I find</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">little utility in having the identifier I authenticate by as being</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Verdana" size="3" style="font: 11.0px Verdana">precisely the same as the URL for my blog.</FONT></P> </BLOCKQUOTE></DIV><BR><DIV>That's a good point, and one I was finding myself unwillingly led toward anyway.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>My resistance to it is on the grounds of simplicity or elegance ... not having too many entities. The URL I use for authentication becomes my identity. It's what will be displayed at other sites. People I associate with online will recognize me by it. People who don't know me will follow that URL to see who I am. It becomes my home page.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>But that role of personal home page has already been taken by the blog, for well-known reasons. It has nicer formatting than I would create by hand. It always shows the latest things I've written, my latest bookmarks and photos.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>So one solution is to make the ID page a static page that has a name and picture and a link to the blog.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>A different one is for the protocol to <I>derive</I> the ID URL from the home/blog URL. Users only see the latter. This is in effect what LID does, by appending query parameters to the URL for all of its protocol operations. The counter-argument, from the OpenID home page is that th<FONT class="Apple-style-span" color="#000000"><SPAN class="Apple-style-span" style="background-color: transparent;">is "Assumes that identity URLs are dynamic documents that can handle fancy URL parameters. Not true in real life, which is key for adoption." I'm not sure why this isn't true in real life — maybe Brad can explain?</SPAN></FONT></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>--Jens</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>PS: I don't mean to march in and start being all argumentative. I love this stuff, and I'm metaphorically kicking the tires pretty hard to convince myself it's as good as I want it to be. No hard feelings, I hope.</DIV></BODY></HTML>