11

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to authenticate to THEM for an unlimited number of sites with one email address, but upon registration with a new site, allow you to enter an arbitrary email address specific to that one site in a textbox before it kicks you back to the site you're registering for?

Why?

Over the years, I've discovered the hard way that there's really only one nearly-foolproof way to avoid spam: I have my mail server configured to allow adhoc aliases, and I use a different email address for every site and sender. Those email addresses are in the form [email protected].

The advantages are many:

  • If I start getting spammed, I can look at the address, and add a Procmail rule to instantly nuke it thereafter at the mail server.

  • It's the only method that actually works if a site or friend/family member/whomever gets compromised by hackers/malware and the address gets harvested.

At the end of the day, it's a lot easier to tell one person or site, "use [email protected] from now on" than to keep nuking email address after email address as they succumb to spammers.

It makes a huge difference. Today alone, I received approximately 12,380 inbound emails addressed to alleged recipients at my domain. 19 of them were non-spam. I actually had to write a cron job to rotate and delete my Procmail logs, because if I didn't, they'd be several gigabytes within a matter of days.

Here's the problem: most sites I've seen that authenticate through OpenID wrongfully treat the address they receive from OpenID as immutable thereafter. If I'm logging in to some OpenID provider as [email protected], and ultimately passing that same email address along to every site I use, my whole strategy would quickly fall apart the moment one of those sites starts spamming me or gets harvested by spammers.

What I'd like to happen is, after authenticating to the OpenID provider, when it gets to the page where it would normally ask me for permission to share my email address with the other site, I'd like to be presented with a dialog box that will allow me to enter whatever unique email address I want to use for that particular site.

So, are there any?

Improve this question
3
  • Sounds like you need to use SpamHaus and require RDNS for the originating IP. Those two alone will cut your spam by at least 80%.
    – Ben
    Jan 20, 2014 at 16:18
  • I use SpamHaus and require RDNS, and check SPF records, and block all of China and Korea, and do a few other things. My spam checker's incoming volume is still around 3x that of Bitbang3r even after doing those early-stage checks.
    – dannysauer
    Sep 4, 2014 at 15:52
  • If there isn't one, you could roll your own OpenID provider that supports it. It won't be easy, but since you've already got a domain...
    – matega
    Mar 7, 2015 at 17:46

2 Answers 2

Reset to default
1

No.

Open authentication works on the premise that it knows who you are. If you could just change who you are after authentication, the whole system wouldn't work as an authentication method.

Try using something like SpamHaus to deal with your problem.

Improve this answer
1
  • No it doesn't. The OpenID standard guarantees NOTHING to web sites/services authenticating through an arbitrary authentication service besides, "The user who associated his credentials with the token you furnished to us (at initial registration, and now) has logged in to our satisfaction". OpenID makes NO explicit guarantees about real-world identity.
    – Bitbang3r
    Feb 27, 2015 at 16:42
1

I do not know any site that does that.

But possible.

Things to keep in mind. There are domains of security and a whole web of discovery mechanisms and such. Most sites just skip the discovery stuff, and pick a handful of providers - google & facebook. Those sites don't support what you're doing.

Ok, so assuming the site you're talking about is using some discovery method, and you control the domain, then you should be able to auth into your server once, and store a unique email address per site you register with.

I do not know any site that does that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .