Skip to main content
Stack Apps

Return to Answer

added 268 characters in body; added 52 characters in body; added 3 characters in body
Source Link
Tyler Carter
Tyler Carter
  • 5.1k
  • 1
  • 15
  • 11

This will probably never be implemented because the OpenID URL of a users is somewhat secret, and would definitely be considered private.On dev.meta.stackoverflow, someone asked this question, and the dev team was very quick to say that the OpenID URL would never be revealed.

There might, however, be a more secure method to validate the User/OpenID connection.

Instead of returning the user's OpenID in the API, another API call would be made to verify it. You would have to send a url encoded version of the OpenID URL to StackOverflow, and they would compare it with the one they have, and if it matches they will return a success method.

This would have to be a limited call (as to prevent guessing), and it would work very similar to a Username/Password system, where that the only way you would get a success is if you gave the correct Username/OpenID combination.

My only fear is that this might anger some users because StackOverflow really isn't suppose to be telling other people what their OpenID is. While it seems like this isn't really giving out the OpenID, it is a way that would make your OpenID not completely hidden.

But then again, this is exactly how passwords work.

This will probably never be implemented because the OpenID URL of a users is somewhat secret, and would definitely be considered private.On dev.meta.stackoverflow, someone asked this question, and the dev team was very quick to say that the OpenID URL would never be revealed.

There might, however, be a more secure method to validate the User/OpenID connection.

Instead of returning the user's OpenID in the API, another API call would be made to verify it. You would have to send a url encoded version of the OpenID URL to StackOverflow, and they would compare it with the one they have, and if it matches they will return a success method.

This would have to be a limited call (as to prevent guessing), and it would work very similar to a Username/Password system, where that the only way you would get a success is if you gave the correct Username/OpenID combination.

This will probably never be implemented because the OpenID URL of a users is somewhat secret, and would definitely be considered private.On dev.meta.stackoverflow, someone asked this question, and the dev team was very quick to say that the OpenID URL would never be revealed.

There might, however, be a more secure method to validate the User/OpenID connection.

Instead of returning the user's OpenID in the API, another API call would be made to verify it. You would have to send a url encoded version of the OpenID URL to StackOverflow, and they would compare it with the one they have, and if it matches they will return a success method.

This would have to be a limited call (as to prevent guessing), and it would work very similar to a Username/Password system, where that the only way you would get a success is if you gave the correct Username/OpenID combination.

My only fear is that this might anger some users because StackOverflow really isn't suppose to be telling other people what their OpenID is. While it seems like this isn't really giving out the OpenID, it is a way that would make your OpenID not completely hidden.

But then again, this is exactly how passwords work.

Source Link
Tyler Carter
Tyler Carter
  • 5.1k
  • 1
  • 15
  • 11

This will probably never be implemented because the OpenID URL of a users is somewhat secret, and would definitely be considered private.On dev.meta.stackoverflow, someone asked this question, and the dev team was very quick to say that the OpenID URL would never be revealed.

There might, however, be a more secure method to validate the User/OpenID connection.

Instead of returning the user's OpenID in the API, another API call would be made to verify it. You would have to send a url encoded version of the OpenID URL to StackOverflow, and they would compare it with the one they have, and if it matches they will return a success method.

This would have to be a limited call (as to prevent guessing), and it would work very similar to a Username/Password system, where that the only way you would get a success is if you gave the correct Username/OpenID combination.