@jco hehe. However, what to do when openid does not give me their/his email?

then you make one up

my preferred method is username@example.com

alternately, parse out the http:// and the path after the / and use the sitename as the email

so mine would have been _________@www.google.com

ah. You didn't get me.

I mean ... When I am registered with ______@www.google.com

and when I try to log out with openID (google)

I didn't get you

say that again

yes. Say my openid is phpcode.eu

and I'm registered with my email

accidently, openID does not give my server user's email

what to do then?

then nothing

you will have two accounts

what stops a person on Stack Overflow from making two accounts with two different openids?

nothing

currently I'm trying to use $openid->required = array('contact/email');

ok

print_r($openid->getAttributes());

@genesis you should never write code to run on ballistic weapons. You'd be consumed while handling the case where they blow up.

@Tim What do you mean?

heheh, sometimes things just require human intervention. An OpenID endpoint breaking horribly is one of those cases.

The thing with OpenID, updates across providers can't possibly be atomic, and users forget things.

You are a very defensive programmer. But you can't defend against certain things you must trust :)

@Tim Post yes I know :)

Security is the first thing I'm thinking about

Okay timpost, if you know something about myopenid, tell me few things

1. When user uses openiD which isn't sending email, how should I recognize his account

Not quite clear what you mean?

2. from what should I take user from? I'm using SELECT * FROM openid WHERE openid = '".$openid->identity."'

@TimPost myopenid.com does not send email by default

Ahh, you mean in their response

yes

@Tim so?

Why is the URI problematic for that?

It isn't

if I'm darthvader.myopenid.com .. well :)

I must be Darth Vader. MyOpenID says I am.

The point is the user authenticated for that endpoint, you don't need an e-mail. Universally, just make a hash of the endpoint

and select based on that

wait, so are you sure someone couldn't jus use my openid/spoof my openid ?

How are you going to spoof tinkertim.myopenid.com ?

With the associated hash, which you can re-hash?

openid.identity=http%3A%2F%2Fgenesis19.myopenid.com%2F

into return url?

I'm assuming you didn't try that yet.

no

so it won't work?

Umm, no.

how is it possible?

To my knowledge, it isn't

how can my server know it isn'T spoofed?

I know that when I refresh page returned by openid server, it's denied

but I have no idea how is it possible

How can you prevent a MITM attack when a rogue CA starts issuing trusted certs?

At some point, you have to stop contemplating what if and realize that nothing which interacts with TCP/IP is ever going to be perfect.

okay. hey, but when I use google, my identity is [identity:LightOpenID:private] => google.com/accounts/o8/id

Great, make a signed 32 bit hash of that and select based on it

Really, you're over thinking here :)

no no no

oh wait!

[openid_identity] => google.com/accounts/o8/id?id=Asome_some_somelonger

How you want to store that depends on what you are building

@Tim could you try please? stackoverflow.phpcode.eu/login

just click google

Umm, the selector buttons don't take me to an endpoint. I'm using chrome 12---- ---13 I mean 14

let me try in FF

put google.com/accounts/o8/id into that insert

> No OpenID Server found at stackoverflow.phpcode.eu/login

huh? Screen?

You want a screen shot of a single line of text?

@TimPost who?

> stackoverflow.phpcode.eu/login.php

so when you insert "https://www.google.com/accounts/o8/id" into that input box and press submit it redirects you to google, back to login.php with this message?

oh, very strange. IT's working for me, fine

You have a session opened, perhaps?

where?

I don't know, I'm wondering why it's different for you than it is for me

if you try again, do you see ERROR prepended?

Yes, now I do

try{}catch{} :/

sorry for bothering you, but can you try again?

Sure

and tell me the response?

Same

exactly the same? it should show it 5 times

oh sorry, wrong dir

Once only

okay, now

POST /login.php - is it correct now?

Yes, now five times

and nothing more?

could we move?

@TimPost If you didn't get notification

chat.meta.stackoverflow.com/rooms/418/…