Re: [webfinger] Automated Service Configuration now uses webfinger

[Jesse Thompson <[e-mail]>]

On 7/5/13 9:17 AM, Cyrus Daboo wrote:
> Hi folks,
> I have recently posted a new version of the Automated Service
> Configuration draft (formerly known as Aggregated Service Discovery):
> <https://datatracker.ietf.org/doc/draft-daboo-aggregated-service-discovery/>.
>
>
> This protocol now makes use of webfinger to "bootstrap" discovery of the
> config document. Hopefully it will serve as a useful example of how
> webfinger can be used by specific applications. I would appreciate
> feedback from the webfinger community on how we have gone about using
> webfinger, thanks.

Since "the target FQDN is not in the queried domain" will apply to the 
vast majority of email/calendar domains (hosted by Google, Microsoft, etc):

When it comes to practical implementation, essentially no clients will 
bother to "verify with the user that the link URI target FQDN is 
suitable for use before executing any connections to the host", 
especially if they already have an auto-config scheme that doesn't 
prompt the user (e.g. Thunderbird).

It might be beneficial to the adoption of this standard to bake in a 
method of secure delegation that could work from day one.

Jesse