Subject: [webfinger] Vision for Webfinger - what are we doing?

From: Eric Mill <[email-masked]>
Date: Mon, 14 Oct 2013 23:21:33 -0400

Hey all,

I was at a hackathon
<http://fedscoop.com/code-dc-calls-furloughed-feds/> today,
and spent the day working on Webfinger libraries for
Sinatra<https://github.com/konklone/sinatra-webfinger>and
Jekyll <https://github.com/konklone/jekyll-webfinger>. It was really
productive, but -- at the end of the day, a reporter was there asking
everybody questions about their projects.

When he asked what Webfinger was for, I realized that the original
easy-to-communicate killer app for Webfinger, easing universal login
through OpenID,
was<http://productblogarchive.37signals.com/products/2011/01/well-be-retiring-our-support-of-openid-on-may-1.html>
dead <https://www.myopenid.com/>. The only thing I could think to say was
"Remember OpenID? Before it died? Well, this is a piece of the puzzle to
putting something like that back together again."

That didn't feel like a very impressive answer. So, now that OpenID is
dead, what's the one line explanation for why Webfinger is important?
What's the path forward to making Webfinger something people are
incentivized to support?

Should we be pushing really hard to resuscitate OpenID via OpenID Connect?
Do we just need to wait for internal lobbying inside of
Google/Microsoft/Twitter/etc to pay off in some announcement? I know
Webfinger supports more than email lookup -- is there some particular
killer app people were envisioning when they lobbied for that feature?

I'm so happy there's finally an RFC, after so many years. I recognize how
much work was put in to make that happen, and this shouldn't be taken as a
criticism of anyone. I just want to know what others see for the future of
Webfinger, and what I should do next.

-- Eric

-- 
konklone.com | @konklone <https://twitter.com/konklone>

---

From: Brad Fitzpatrick <[email-masked]>
Date: Tue, 15 Oct 2013 10:32:45 -0700

Encrypted email: the MUA can discovery the user's public key before
mailing, and encrypt it before it hits the first SMTP server.

Sending money with bitcoin: discovery the receipient's public wallet
address from their email address, or an endpoint to generate a wallet
address as a function of the sender.

etc

It makes email addresses readable for any use case, instead of just
SMTP-writable.

On Mon, Oct 14, 2013 at 8:21 PM, Eric Mill <[email-masked]> wrote:

> Hey all,
>
> I was at a hackathon <http://fedscoop.com/code-dc-calls-furloughed-feds/> today,
> and spent the day working on Webfinger libraries for Sinatra<https://github.com/konklone/sinatra-webfinger>and
> through OpenID, was<http://productblogarchive.37signals.com/products/2011/01/well-be-retiring-our-support-of-openid-on-may-1.html>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>
>

---

From: "Paul E. Jones" <[email-masked]>
Date: Tue, 15 Oct 2013 15:23:50 -0400

Eric,

OpenID is not entirely dead, yet.  I still run my own OpenID OP server 
and use it to log into some sites.  I still allow OpenID logins on 
forums.packetizer.com, too.  It's still in use, but the large sites just 
didn't have enough users using it, so they axed it.  On its heels, 
though, is now OpenID Connect and it will use WebFinger for discovery.  
so, sure... push it :-)

Personally, I can think of a lot of good uses for WebFinger:
* When I log onto a web site, I want the site to grab my name an picture 
automatically.
* If I want somebody to send me bitcoins, I'd much rather give them my 
email address (and I do have that in my WF account)
* My contact info is published via WebFinger, so I don't have to give 
people a lot of info on a business card
* WebFinger will hopefully be used as the starting point for 
auto-provisioning of email clients or other devices and applications 
where one has to enter server and port information

Paul

On 10/14/2013 11:21 PM, Eric Mill wrote:
> Hey all,
>
> I was at a hackathon 
> <http://fedscoop.com/code-dc-calls-furloughed-feds/> today, and spent 
> the day working on Webfinger libraries for Sinatra 
> <https://github.com/konklone/sinatra-webfinger> and Jekyll 
> <https://github.com/konklone/jekyll-webfinger>. It was really 
> through OpenID, was 
> <http://productblogarchive.37signals.com/products/2011/01/well-be-retiring-our-support-of-openid-on-may-1.html> 
> dead <https://www.myopenid.com/>. The only thing I could think to say 
> was "Remember OpenID? Before it died? Well, this is a piece of the 
> puzzle to putting something like that back together again."
>
> Should we be pushing really hard to resuscitate OpenID via OpenID 
> Connect? Do we just need to wait for internal lobbying inside of 
> I'm so happy there's finally an RFC, after so many years. I recognize 
> how much work was put in to make that happen, and this shouldn't be 
> taken as a criticism of anyone. I just want to know what others see 
> for the future of Webfinger, and what I should do next.
>
> -- Eric
>
> -- 
> konklone.com <http://konklone.com> | @konklone 
> <https://twitter.com/konklone>
>
>

---

From: Kingsley Idehen <[email-masked]>
Date: Tue, 15 Oct 2013 15:48:17 -0400

On 10/15/13 3:23 PM, Paul E. Jones wrote:
> forums.packetizer.com, too.  It's still in use, but the large sites 
> just didn't have enough users using it, so they axed it.  On its 
> heels, though, is now OpenID Connect and it will use WebFinger for 
> discovery.  so, sure... push it :-)
>
> * When I log onto a web site, I want the site to grab my name an 
> picture automatically.

All,

Here's a simple and useful thing that can be achieved with Webfinger:

You notarize digital identity cards (aka. X.509 certificates) where an 
acct: scheme URI in the certificate's SAN (Subject Alternative Name) 
enables X.509 based verifiable identity beyond Email oriented S/MIME. It 
also means you can construct sophisticated ACLs and Data Access Policies 
for a Global Read-Write Web.

We have just released version 1.3.0 of our YouID app for iOS that 
supports what I've outlined above. This product has actually supported 
Webfinger since its inception. What we would liked to have been able to 
add for acct: URIs and Webfinger lookups is the ability for anyone to 
host their profile document via services such as Dropbox, Google Drive, 
SkyDrive, Box. etc., which is what's achieved via http: scheme URIs.

Links:

1. http://youid.openlinksw.com -- home page
2. http://bit.ly/19McSik -- G+ note about the 1.3.0 release.

Kingsley

>> That didn't feel like a very impressive answer. So, now that OpenID 
>> is dead, what's the one line explanation for why Webfinger is 
>> important? What's the path forward to making Webfinger something 
>> people are incentivized to support?
>>

-- 

Regards,

Kingsley Idehen	
Founder & CEO
OpenLink Software
Company Web: http://www.openlinksw.com
Personal Weblog: http://www.openlinksw.com/blog/~kidehen
Twitter/Identi.ca handle: @kidehen
Google+ Profile: https://plus.google.com/112399767740508618350/about
LinkedIn Profile: http://www.linkedin.com/in/kidehen

---

From: Melvin Carvalho <[email-masked]>
Date: Wed, 16 Oct 2013 13:28:20 +0200

> Webfinger, and what I should do next.

When Brad created the great grand father of OpenID, codename Yadis, it
actually had a web based discovery system called FOAF.  Even though FOAF
got to a certain degree of popularity (several million users) users there
was a point in time when it became less popular.  We dont really know the
reason for this, but people say that the XML serialization was unwieldy,
there was a lot of complexity baked in (e.g. OWL) and there was no
standardization of privacy.

Whatever the reason, it simply fell out of fashion, particularly on the
west coast, and a new system, XRD was created as a rival.  In truth XRD and
FOAF data models (RDF) were very similar (both follow the subject /
property / value model), but they were developed independently.  XRD became
the basis of both OpenID and Webfinger.  Both FOAF and XRD now have JSON
serializations which is where we get today's JRD, which I think many
developers prefer.

Webfinger was originally conceived to get an XRD/JRD for an email address,
but somewhere along the way, with multiple authors it become more generic
as a general purpose discovery system, much like the technology behind
FOAF.  In fact today the email use case (mailto:) is no longer is part of
the core, and we have discovery on the new URI scheme acct: which Eran put
in before he left.  There's many theories on why acct: was invented, but
imho, it's because Eran worked out that an email address is the OBJECT of a
data structure and not the SUBJECT, so we were missing a subject.  Since
XRD has no query language, a term to create a subject needed to be
created.  Hence we have acct:

The 5 years of discussion of webfinger mirror quite closely the first 5
years of discussion RDF (aka the semantic web aka web of data aka Linked
Data).  The path towards a model where you have entities as URIs and key
value pairs linked to them seems quite similar.

However, as of today, the world is slightly split by two systems that do
more or less the same thing.  Sadly, they are not 100% compatible with each
other at this time, RDF is a more powerful version of XRD, and I would say
probably has more people developing it and adoption, particularly at
enterprise level.

Things have move slightly closer together over time, and maybe the dream
one day is to have a giant web based discovery system with webfinger being
one important aspect, particularly for finding information on email
addresses.  We'll have to wait and see!

---

From: Eric Mill <[email-masked]>
Date: Wed, 16 Oct 2013 11:38:17 -0400

This is all helpful to hear, and I hope these all come to fruition,
especially OpenID Connect. I'll take a stab at setting up my own OpenID
Connect service on my domain and see how it feels.

I guess it's inevitable that we have to hope the big companies make a
meaningful gesture, too. Giving Google's outdated Webfinger
endpoint<https://gmail.com/.well-known/host-meta> for
Gmail a big update would be a great start.

On Tue, Oct 15, 2013 at 3:23 PM, Paul E. Jones <[email-masked]>wrote:

>  Eric,
>
> OpenID is not entirely dead, yet.  I still run my own OpenID OP server and
> use it to log into some sites.  I still allow OpenID logins on
> didn't have enough users using it, so they axed it.  On its heels, though,
> is now OpenID Connect and it will use WebFinger for discovery.  so, sure...
> push it :-)
>
> auto-provisioning of email clients or other devices and applications where
> one has to enter server and port information
>
> Paul
>
>
> how much work was put in to make that happen, and this shouldn't be taken
> as a criticism of anyone. I just want to know what others see for the
> future of Webfinger, and what I should do next.
>
>  -- Eric
>
>  --
> webfinger mailing [email-masked]://www.ietf.org/mailman/listinfo/webfinger
>
>
>