diff options
| author | Joey Hess <joey@kitenet.net> | 2010-09-26 22:27:50 -0400 |
|---|---|---|
| committer | Joey Hess <joey@kitenet.net> | 2010-09-26 22:27:50 -0400 |
| commit | e789cb9c84ba22570de18ff530c428c6fbe56e77 (patch) | |
| tree | c089d4bb3e039cbf028acdebc0625c030914e66b /doc/news/openid | |
| parent | 1883e31de2044eba87035c7bbb4b34c45fefa432 (diff) | |
| parent | 759260f7c836f3491d4250e77aea2c14ad9369b5 (diff) | |
Merge branch 'master' of ssh://git.ikiwiki.info/srv/git/ikiwiki.info
Diffstat (limited to 'doc/news/openid')
| -rw-r--r-- | doc/news/openid/discussion.mdwn | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/doc/news/openid/discussion.mdwn b/doc/news/openid/discussion.mdwn index c0447a13f..bc9856ad9 100644 --- a/doc/news/openid/discussion.mdwn +++ b/doc/news/openid/discussion.mdwn @@ -90,3 +90,7 @@ I just tried logging it with OpenID and it Just Worked. Pretty painless. If yo ###LiveJournal openid One caveat to the above is that, of course, OpenID is a distributed trust system which means you do have to think about the trust aspect. A case in point is livejournal.com whose OpenID implementation is badly broken in one important respect: If a LiveJournal user deletes his or her journal, and a different user registers a journal with the same name (this is actually quite a common occurrence on LiveJournal), they in effect inherit the previous journal owner's identity. LiveJournal does not even have a mechanism in place for a remote site even to detect that a journal has changed hands. It is an extremely dodgy situation which they seem to have *no* intention of fixing, and the bottom line is that the "identity" represented by a *username*.livejournal.com token should not be trusted as to its long-term uniqueness. Just FYI. --[[blipvert]] + +---- + +Submitting bugs in the OpenID components will be difficult if OpenID must be working first... |