googleのopenid実装をめぐる誤解

googleはopenidの実装でまだopenidのIDを提供する提供側でしかないが，そのgoogleのopenid実装方法をめぐり開発者の間で誤解が起きている。一番大きな誤解はgoogleがopenidのIDとして，ユーザーの一部にしか理解できないようなopenid用のurlではなく，単純にgmailアドレスを使ったことで，本来のopenidスペックからかけ離れた別のフォークを作っているといったものだ。しかしgoogleの開発者に言わせればこれはDirected Identityという技術を使ったれっきとしたOpenID 2.0スペックであり，Directed Identityを使えばユーザーが一般的なドメイン･ネームで入力すればよくなるとしている。結論から言えばスペックにしたがって実装されたもので誰もフォークをつくろうとはしていないことだ。理想的にはurlのみとするのが本筋で，今後予想されるケータイ番号などによるurlベースでないIDに関しても，ユーザーが選んだIDをurlへマッピングできるようにすればいいが，そのような新しいコンセプト自体はOpenID 2.0へ持ち込むべきではない。

The key problem Google had with their OpenID implementation is that they want their users to log-in with information they know (i.e. their gmail address) instead of some made up URL that is their Google OpenID identifier. Since only the Über geeks in their user base would know their Google OpenID URL if they went with that approach. With Google's approach meant that only sites that had been hardcoded to support Google's flavor of OpenID would be supported.

http://www.25hoursaday.com/weblog/2008/11/07/WhyGoogleForkedOpenIDAndOtherStories.aspx

The first criticism has something to do with the erroneous notion that, simply because the Google IDP supports the indirect lookup of a user's identity, this is somehow an invalid use of the OpenID protocol. On the contrary, it is using a standard technique known as Directed Identity, which can be found in the OpenID 2.0 specification here. Directed Identity allows users to enter a generic domain name (e.g.., "example.com"), rather than a fully qualified identity (e.g., "example.com/users/bob"), so that they can use their identity provider to make an informed decision about how much personal information to expose to the RP. This is a good thing. You want this. You want to be able to make that disclosure choice yourself.

http://blog.unto.net/miscellaneous/clearing-up-inaccuracies-about-the-google-openid-idp-launch/#