I've come across what appears to be the world's first publicly
advertised Sputnik job - for integrating Sputnik with OpenID.

http://hephoo.notlong.com

So, first of all, let me welcome the emergence of the global Sputnik
job market. :)

Second, I have no idea who the buyer is and what their project is
about, but perhaps they'll consider donating the code to the project.
OpenID would be a great addition to Sputnik, and I would be happy to
acknowledge the donation, maintain the plugin and help with advice.

  - yuri

-- 
http://spu.tnik.org/

_______________________________________________
Sputnik-list mailing list
Sputnik-list@lists.luaforge.net
http://lists.luaforge.net/cgi-bin/mailman/listinfo/sputnik-list

On Mon, Jan 26, 2009 at 1:36 AM, Yuri Takhteyev wrote:
> OpenID would be a great addition to Sputnik

Perhaps.  Still, I think it has some fundamental issues that require caution:

 http://self-issued.info/?p=73
 http://webworkerdaily.com/2008/05/21/openid-a-contrarian-view/

E.g. relying on an untrusted site to redirect the user to their master
login page strikes me as regressive.

_______________________________________________
Sputnik-list mailing list
Sputnik-list@lists.luaforge.net
http://lists.luaforge.net/cgi-bin/mailman/listinfo/sputnik-list

> E.g. relying on an untrusted site to redirect the user to their master
> login page strikes me as regressive.

True. If someone decided to use Sputnik to implement a web interface
for a bank, I would probably advise them against using OpenID. :)
Doing OpenID authentication for non-admin access to a wiki, however,
probably wouldn't keep me up at night.

Also, the security of OpenID depends on the steps the provider takes
to prevent phishing. Some providers are better than others. There are
now OpenID providers that use customized image (Yahoo!), hardware
tokens (Verisign), or browser certificates (certifi.ca). Some can be
configured to call your cell phone as a part of the login
(myopenid.com). If the consumer can be configured to only accept
logins from trusted providers, then OpenID could be _more_ secure than
most site's authentication.

- yuri

-- 
http://spu.tnik.org/

_______________________________________________
Sputnik-list mailing list
Sputnik-list@lists.luaforge.net
http://lists.luaforge.net/cgi-bin/mailman/listinfo/sputnik-list