« first day (409 days earlier)
← previous day
next day →
last day (4624 days later) »
05:00 - 19:00
19:00 - 21:00
genesis-φ
7:06 PM
@jco hehe. However, what to do when openid does not give me their/his email?
jcolebrand
then you make one up
my preferred method is username@example.com
alternately, parse out the http:// and the path after the / and use the sitename as the email
so mine would have been _________@www.google.com
genesis-φ
ah. You didn't get me.
I mean ... When I am registered with ______@www.google.com
and when I try to log out with openID (google)
jcolebrand
I didn't get you
say that again
genesis-φ
yes. Say my openid is phpcode.eu
and I'm registered with my email
accidently, openID does not give my server user's email
what to do then?
jcolebrand
then nothing
you will have two accounts
what stops a person on
Stack Overflow
from making two accounts with two different openids?
nothing
genesis-φ
7:12 PM
currently I'm trying to use $openid->required = array('contact/email');
jcolebrand
ok
genesis-φ
print_r($openid->getAttributes());
gives me
Array ( )
Tim Post
@genesis you should never write code to run on ballistic weapons. You'd be consumed while handling the case where they blow up.
genesis-φ
@Tim What do you mean?
Tim Post
heheh, sometimes things just require human intervention. An OpenID endpoint breaking horribly is one of those cases.
The thing with OpenID, updates across providers can't possibly be atomic, and users forget things.
You are a very defensive programmer. But you can't defend against certain things you must trust :)
genesis-φ
7:29 PM
@Tim Post yes I know :)
Security is the first thing I'm thinking about
Okay timpost, if you know something about myopenid, tell me few things
1. When user uses openiD which isn't sending email, how should I recognize his account
Tim Post
Not quite clear what you mean?
genesis-φ
2. from what should I take user from? I'm using SELECT * FROM openid WHERE openid = '".$openid->identity."'
@TimPost
myopenid.com
does not send email by default
Tim Post
Ahh, you mean in their response
genesis-φ
yes
@Tim so?
Tim Post
Why is the URI problematic for that?
genesis-φ
7:35 PM
It isn't
Tim Post
if I'm darthvader.myopenid.com .. well :)
I must be Darth Vader. MyOpenID says I am.
The point is the user authenticated for that endpoint, you don't need an e-mail. Universally, just make a hash of the endpoint
and select based on that
genesis-φ
wait, so are you sure someone couldn't jus use my openid/spoof my openid ?
Tim Post
How are you going to spoof tinkertim.myopenid.com ?
With the associated hash, which you can re-hash?
genesis-φ
openid.identity=http%3A%2F%2Fgenesis19.myopenid.com%2F
into return url?
Tim Post
I'm assuming you didn't try that yet.
genesis-φ
7:39 PM
no
so it won't work?
Tim Post
Umm, no.
genesis-φ
how is it possible?
Tim Post
To my knowledge, it isn't
genesis-φ
how can my server know it isn'T spoofed?
I know that when I refresh page returned by openid server, it's denied
but I have no idea how is it possible
Tim Post
How can you prevent a MITM attack when a rogue CA starts issuing trusted certs?
At some point, you have to stop contemplating what if and realize that nothing which interacts with TCP/IP is ever going to be perfect.
genesis-φ
7:41 PM
okay. hey, but when I use google, my identity is [identity:LightOpenID:private] =>
google.com/accounts/o8/id
Tim Post
Great, make a signed 32 bit hash of that and select based on it
Really, you're over thinking here :)
genesis-φ
no no no
oh wait!
[openid_identity] =>
google.com/accounts/o8/id?id=Asome_some_somelonger
Tim Post
How you want to store that depends on what you are building
genesis-φ
@Tim could you try please?
stackoverflow.phpcode.eu/login
just click google
Tim Post
Umm, the selector buttons don't take me to an endpoint. I'm using chrome
12---- ---13
I mean 14
let me try in FF
genesis-φ
7:47 PM
put
google.com/accounts/o8/id
into that insert
Tim Post
> No OpenID Server found at
stackoverflow.phpcode.eu/login
genesis-φ
huh? Screen?
Tim Post
You want a screen shot of a single line of text?
genesis-φ
@TimPost who?
Tim Post
>
stackoverflow.phpcode.eu/login.php
genesis-φ
7:50 PM
so when you insert "https://www.google.com/accounts/o8/id" into that input box and press submit it redirects you to google, back to login.php with this message?
Tim Post
genesis-φ
oh, very strange. IT's working for me, fine
Tim Post
You have a session opened, perhaps?
genesis-φ
where?
Tim Post
I don't know, I'm wondering why it's different for you than it is for me
genesis-φ
7:52 PM
if you try again, do you see ERROR prepended?
Tim Post
Yes, now I do
genesis-φ
try{}catch{} :/
sorry for bothering you, but can you try again?
Tim Post
Sure
genesis-φ
and tell me the response?
Tim Post
Same
genesis-φ
7:57 PM
exactly the same? it should show it 5 times
oh sorry, wrong dir
Tim Post
Once only
genesis-φ
okay, now
POST /login.php - is it correct now?
Tim Post
Yes, now five times
genesis-φ
and nothing more?
could we move?
@TimPost If you didn't get notification
chat.meta.stackoverflow.com/rooms/418/…
05:00 - 19:00
19:00 - 21:00
« first day (409 days earlier)
← previous day
next day →
last day (4624 days later) »
all rooms
Transcript for
Sep
16
Sep '11
17
Sep
18
Tavern on the Meta
MY GOD, IT'S FULL OF STARS AND BACKLOG! General friendly chit-...
8
5
bug
crickets
discussion
excuses
support
waffles
join this room
about this room
00:00
06:00
12:00
18:00
all times are UTC
site design / logo © 2024 Stack Exchange Inc;
legal
mobile