More details here: http://lists.openid.net/pipermail/openid-security/2013-Decem...