A Critical Look At OpenID
Notes from the A Critical Look At OpenID at SXSW.
SSO with single authority betrays the core principles of the web. OpenID is a shared standard that uses URLs as identifiers. The OpenID protocol lets you prove that you own a URL. This means that OpenID can be used an authentication token.
Overview
When logging into to a new third party site with OpenID you are bounced to the authority for your URL. That URL then can remember that you trust this other application and bounce you past if you are still cookied into that other site when you come back later.
This can also be used for registration using the Simple Registration functionality of OpenID. This allows users to select attributes that will be exchanged with the third party site.
In OpenID 2.0 users can enter the address of a provider instead of a provider. The provider will then ask for your username and password or allow you to choose between multiple identities.
OpenID is very similar to Email
- Pick a provider to trust
- Users of different providers can interoperate
- Can be used for SSO (email is used for remember password communication)
- user@URL.com means that user is associated with URL.com
Although these are similar in this metaphor, OpenID is both a better user experience and much more secure than email if SSL is used for OpenID authentication.
One critique of OpenID is that it allows a single point of failure. This is no different than the current situation because your email address is a de facto SSO if the same address is associated with all of your accounts.
Security
Providers are now beginning to compete on anti-phishing and security features. Users can be protected by second factor strong authentication
The OpenID community can also whitelist providers which will help manage the business risk.
Yahoo Example
Yahoo is an OpenID proverider but does not support OpenID for Yahoo properties. Yahoo only supports OpenID 2 and will not suport OpenID 1.
OpenID 2 is supported by Drupal, Plone, and Wordpress.
Ingestion
37Signals support is significant because thir support of the spec has encouraged support in an ecosystem.
Q&A
Q: Identity Theft
A: Fail over to other systems helps with identities dissapearing. The theft issue is harder and OpenID is, at least, not worse than the current system.
Q: Future of attribute exchange
A: Getting better but not widely supported yet. Simple Registration has been around a while but only supports a fixed set of nine fields.
Q: Barriers to use
A: Usability, security, and technology are the key issues. To solve usability issue, one method is to connect the service their using with specific other providers. Providers can also work hard to educate users that they have a highly portable ID.
0 TrackBacks
Listed below are links to blogs that reference this entry: A Critical Look At OpenID.
TrackBack URL for this entry: http://www.samfelder.com/mt/mt-tb.cgi/326
1 Comments
Leave a comment
Who is this guy?
Looks like it was an interesting discussion, although it doesn't sound like it was too "critical" ... or maybe you just highlighted all of the positive aspects! Personally, I happen to like OpenID myself (I used mine to log on to your site!), but it's always interesting to hear opposing views ...