Re: [OAUTH-WG] [kitten] OAuth Discovery and what the relying partyneeds to know

2012-05-10 Thread John Bradley
openID Connect dosen't require a user portion of the identifier to be discovered and supports a opaque or pseudonymous user_id. email is an optional attribute that can be returned by user consent. OpenID 2.0 actively discouraged using email addresses for privacy reasons. Teaching people to

Re: [OAUTH-WG] [kitten] OAuth Discovery and what the relying partyneeds to know

2012-05-10 Thread Justin Richer
It's important to remember that these identifiers need to be handled, seen, and remembered by people. Especially in the long-tail case (which is to say, IdPs who aren't big enough to get a log in button), users will need to enter a piece of text into a website to tell the website who they are.

Re: [OAUTH-WG] [kitten] OAuth Discovery and what the relying partyneeds to know

2012-05-10 Thread John Bradley
Allowing user based discovery is not mutually exclusive with things that provide browser based help for selecting a IdP. Forcing a user to type a email address for twitter may also prove unnatural. More help for the user by their trusted user agent is probably the better way to go in the long