Slashdot Log In
The Case for OpenID
Posted by
Zonk
on Tue Dec 05, 2006 08:25 AM
from the halt-and-identify-yourself dept.
from the halt-and-identify-yourself dept.
An anonymous reader writes "VeriSign and NetMesh are making the case for OpenID, the grass-roots, decentralized digital identity system already supported by LiveJournal, Six Apart, Technorati, VeriSign and many startups, reportedly growing 5% every single week. They say OpenID 'is fundamentally different from other identity technologies' because it is a 'fully decentralized system' and has a 'much lighter cost structure' than any alternative, like Microsoft Passport, CardSpace or Liberty Alliance. Time to remove username and password from your site and add OpenID libraries instead, so visitors can authenticate with their blog URL?" From the article: "If tomorrow, for example, you decide you don't like the Diffie-Hellman cryptographic key exchange at the root of OpenID authentication, you can develop your own way of authenticating, and deploy it within the OpenID framework. If you have an idea for a new identity-related service that nobody else ever thought of, you can deploy it into the OpenID framework as soon as your code is ready. This radical decentralization on all levels of the stack, both technically and organizationally, is a very strong catalyst for attracting innovators and their innovations. This makes OpenID a superior choice for identity-related innovation."
Related Stories
[+]
LiveJournal Founder Launches OpenID System 172 comments
geekdreams writes "Brad Fitzpatrick, the founder of LiveJournal, has launched OpenID, an 'actually distributed identity system' for websites that accept user comments. The system utilizes decentralized servers to authenticate users, and aims to replace centralized ID systems such as Microsoft's Passport and SixApart's TypeKey. The first implementation of OpenID can be seen on LiveJournal comments pages." Previously mentioned on Slashdot, now out of development.
[+]
Your Rights Online: Gates Says Microsoft Will Support OpenID 73 comments
An anonymous reader writes "In his RSA conference keynote today, Bill Gates announced that Microsoft will support the decentralized OpenID digital identity protocol, in addition to WS-* and CardSpace (transcribed notes, video). From its roots in LID, i-names, and Sxip, the first major deployment in LiveJournal, and now with support from Techorati, Magnolia, Symantec, a suspected mass-deployment by AOL, and a number of startups — using URLs as digital identities has caught hold."
[+]
Your Rights Online: AOL Now Supports OpenID 163 comments
Nurgled writes "On Sunday John Panzer announced that AOL now has experimental OpenID server support. This means that every AOL user now has an OpenID identifier. OpenID is a decentralized cross-site authentication system which has been growing in popularity over the last few months. AOL is the first large provider to offer OpenID services, and though they do not currently accept logins to their services with OpenID identifiers from elsewhere, they are apparently working on it. The next big challenge for OpenID proponents is teaching AOL's userbase how to make use of this new technology."
[+]
Moving Beyond Passwords For Security 235 comments
Naturalist writes with an excerpt from a New York Times story about the need for a more secure method for identification than the password-based system almost everyone currently uses. The article also discusses the weaknesses of the OpenID initiative to simplify the process.
"The solution urged by the experts is to abandon passwords -- and to move to a fundamentally different model, one in which humans play little or no part in logging on. Instead, machines have a cryptographically encoded conversation to establish both parties' authenticity, using digital keys that we, as users, have no need to see. ...OpenID offers, at best, a little convenience, and ignores the security vulnerability inherent in the process of typing a password into someone else's Web site. Nevertheless, every few months another brand-name company announces that it has become the newest OpenID signatory."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
No way! (Score:4, Insightful)
Urgh, no way! I do not want all my identities to be tied together through one system. My actions on one site should in no way, shape or form be able to be tied in with what I do on other sites. Compartmentalizing my online life is the best remaining way to remain a modicum of privacy and stave off easy identity theft.
Any website switching to openID exclusively will lose my business. (Of course, if they offer it in addition to a standalone u/p, I'm fine with that, although I do fear that once it gets enough momentum, the standalone u/p will disappear after all.) :/
Re:No way! (OK, Setup several IDs) (Score:5, Informative)
There's no need to abandon a place just because they use openID. Why not setup multiple IDs with different user names, passwords, and email addresses? (I assume that's possible under OpenID?).
I agree that a single collection of IDs (all-eggs-one-basket) represents a dangerous single point of failure. But just because someone implements a new potentially better basket doesn't mean you have to put all your eggs in that basket or avoid using sites that use that type of basket.
Parent
Re:No way! (Score:5, Interesting)
There's been discussion of OpenID providers offering aliases, so you could have a number of distinct "IDs" you mix-and-match with, but they're all validated by an OpenID provider. I don't think the spec says one way or another regarding this; it would be a feature of whichever OpenID provider you used for your identity.
Parent
Re:No way! (Score:5, Interesting)
The second point is that nobody's holding a gun to your head and forcing you to use it. If you don't like it, just create a new password for each site anyway. It doesn't prevent that.
(Sidenote: Stop requiring registration for moronic things! I don't want to give you any personal information to post in a damned blog!)
(Also, why do all these misguided technophobe posts always get modded up first? I thought this was a site for technology enthusiasts.)
Parent
Re: (Score:2)
(Also, why do all these misguided technophobe posts always get modded up first? I thought this was a site for technology enthusiasts.)
I'm sure all of them will be extremely enthusiastic about my new uber-cool, super high tech suicide machine.
Re: (Score:3, Funny)
Re:No way! (Score:4, Interesting)
Then try an approach that I've found incredibly useful... use generated site passwords along with address extensions!
First, for passwords, you only need to remember *1* and have the following javascript (which runs client side) from this most excellent site:
GenPass. [zarate.org]
Next, look into using address extensions (ala what are available via postfix) and define unique addresses per each site you visit (most that I visit have adopted the email address as the username).
For those not familiar with address extensions, you get a base user id within your email system that you're allowed to dynamically apply an extension to and it'll still get delivered to your base box. So, if you're "sam@abc.com" with an extension, the address "sam+slashdot@abs.com" will still deliver to your base mailbox.
Then it is trivial to figure out which site leaked your address for spam as well as start blocking a particular address (either by using procmail or a combination of postfix with an SMTP proxy such as smtpprox. [latency.net]
And while we need to tech savvy of the world setting up the mailserver side of things for our less tech-interested friends (I've done this for friends and family and host mail for them), it simplifies by effectively making it easier to manage multiple identities instead of depending on a bastion one.
Parent
Way! (Score:3, Insightful)
Expecting actual humans to remember a host of usernames and passwords just to be able to participate in online discussions and shop for a book is not acceptable. Why can't techies get it through their heads that user friendliness is an important part of elegant software design? Security people seem to have the hardest time with this
Re:No way! (Score:5, Insightful)
As the GP said, you CAN make multiple identities. For example, make a "blog-posting" account, and use it to Authenticate to all the blogs in which you want to post. Use it to login to other "annoyance" login websites.
Then make a seperate one for your bank, your credit cards, etc.
The beauty of this system is that its a superclass of the current model -- it has all the capabilities of the established model, plus some more functionality.
Parent
Re: (Score:3, Insightful)
Re: (Score:2)
By the way, do you use the same password on all the websites you visit ? If so, if someone can steal you password (the owner of one of thoses websites can, for example), then he can log into all the accounts that you use with the same password. With an OpenID you only have to remember one password, and there'
Re: (Score:2)
I've always liked the IDEA of OpenID (Score:4, Insightful)
Anyway I'm sure that'll change in the future, but it'd be nice to have now. Or maybe I'm completely blind and there's a reference server implementation hanging around somewhere?
Re: (Score:2)
Irritatingly, I can't find it now, though...
i never liked the IDEA of OpenID (Score:2)
5% weekly growth (Score:5, Funny)
reportedly growing 5% every single week.
Translation: last week the install base consisted of his algebra class. This week he installed it on his mom's computer. Next week he's going to grandma's house and he'll install it there too.
WOW (Score:3, Funny)
Can't be too complicated (Score:4, Insightful)
Re: (Score:2)
For many people, I suspect they will get an OpenID as a side-effect of joining some specific service of interest. For example, IIRC, LiveJournal IDs can be used as OpenIDs. So, people who joined LiveJournal to blog get, as a benefit, an OpenID they can use elsewhere (e.g., commenting on other blogs). So, in the case of your mother, she might well wind up with an OpenID from an existing service that converts to OpenID as a provider -- for example, it would be fairly easy for Yahoo or Google to offer OpenIDs
Re: (Score:2)
Complexity can be hidden, but there are costs. (Score:3, Insightful)
Most people (aka, 'your mom') won't know that they're using an OpenID at all. Instead, they'll probably just think of it as the ID of whatever service provides the OpenID authentication. So LiveJournal or whatever, but potentially in the future a more mainstream provider like Yahoo. I'd expect that sites which used OpenID and catered to a non-technical audience might even disguise the fact that it's OpenID (instead, "Sign in with your LiveJournal ID here
Re:Complexity can be hidden, but there are costs. (Score:4, Informative)
I've got a Wordpress blog for which I found an OpenID plugin. I can go to Livejournal and give it my blog address. It then sends me to my site which asks me "Do you want to trust this site with your identity?" You can trust it once, trust it always, or not at all.
Parent
OpenID is great in theory (Score:4, Interesting)
The problem though is that OpenID is currently just a framework. There is no way to prevent people from making 100 accounts, which is still the problem. Once we have a way of making sure each person only has one account, even if we don't know who that person is and can't identify them in any way, then and only then will social software be able to break through this quality barrier that it is currently capped it. I wrote about one way of doing this here [alexkrupp.com], and there are other ways. Hopefully within the next ten years we can have this problem solved, to enable the next generation of web apps that aren't even possible today.
Re: (Score:3, Insightful)
If you want, instead, to look for good, legitimate users with regular useage patterns, the only thing you need is the data and a single sign-on distributed across the systems. You make it easy to get a bad reputation, and hard to get a good one, just like real life. Then voting systems can more heavily favour the consistently useful users, etc.
Finding the bad guys is whackamole, and useless
Re: (Score:2)
Re: (Score:2, Informative)
Actually, that's something I see as a feature. Some people have facets of their lives that they don't want tied to and searchable by their "pubilc" OpenID. Having multiple OpenIDs allows one to keep their private and work lives separate, for example.
Now, one person having 100 accounts that they use to troll message boards...that's a problem best solved with a reputation system, and OpenID's creators make it clear on
More hyperbolic statistics (Score:3, Insightful)
And WTF does that actually MEAN?
It superifically appears to assert that the number of people using OpenID is growing each week by 5%.
Is this the number of people *actively* using OpenID, or the total number of ALL users ever, e.g. including those by people who've used it once and then walked away?
Is this the totaly number of people across ALL OpenID service providers? this seems unlikely, since someone would have had to have done the work of collating all the stats from all those providers.
If it is then just a sampling of providers, how was the sample chosen? is it representative? or was it opportunistic, e.g. those OpenID service providers who are loudest about OpenID and so could be expected to tend to be those who see the largest growth rate in users?
Also, 5% each week sustained actually means an ever increasing absolute number of users, since it's 5% of an ever larger user base. When your user base is 100 people, 5% is five 5 new people, which isn't hard to sustain on a week in, week out basis. So what is this 5% - which could be completely inaccurate anyway, since we've no idea of the sample it's based - 5% *of*?
idea for a new identity-related service? (Score:2)
Re: (Score:2)
What are real problems in identity? (Score:2)
Entrepreneurs and intrapreneurs, for whom OpenID provides a fertile ground for innovation, such as:
- reputation services, which help both end users and site operators and represent a major business opportunity in itself;
- open social networks that are not confined to a single vendor's site;
- more secure, efficient and accountable messaging systems that one day could replace the protocols that e-mail runs on.
Some have told us they consider the OpenID community to lack a clear pro
Re: (Score:2)
Easy. All the special cases of "How do I make money with this?" to start with.
No matter how good the system, that's going to be limiting factor in vendor support at the outset.
On the right track - id should be portable. (Score:2)
In the real world, we have organizations that create forms of ID, and other organizations that need to identify us. I have a birth certificate, a library card, a passport, and a credit card, for example. These all certify certain personal details about myself, and they don't all cover the same details. What's also important is that they're portable, they're sec
Overly complicated (Score:5, Funny)
Hash: SHA1
OpenID seems rather complex. There are already decentralised systems for authenticating a user's identity. But, if it gains momentum I would be happy to use it. One thing I can't work out is how I can create an identity. I have my own domain name and web site; I don't want to rely on Livejournal or another third party to maintain the notion of my identity.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFdYQlshl/216gEHgRAk00AJwLvC
czXJO4lwp5Znr+A7sS
=MeMH
-----END PGP SIGNATURE-----
Re: (Score:3, Interesting)
Hash: SHA1
Indeed. OpenID also seems too unreliable. What's to say the server my blog is on won't get hacked again? What's to keep the crackers from using that to forge my identity? There's no signing mechanism, no challenge/response, and it doesn't even bother to protect my "identification" from interception or duplication! All it does is prove that I have access to the blog I linked to.
What I want is a complete solution that allows me to prote
Or just allow your email address to be a username (Score:2)
If you're really worried about a low-security "single sign on" solution (which this article seems to suggest), why not just leverage one of the many cookie schemes advertisers use to track you all over the net? (The end result is the same.)
Spam IS a problem for site owners! What to do? (Score:2)
With their own registration system, site owners can add features that make spammy registrations difficult (I'm getting 10 or so daily spammy registrations). Blindly trusting OpenIDs and allowing them into a site, or giving them posting rights would be crazy. So what are the options for countering spam? Can you add extra checks and validation? User verification? Black
Re: (Score:2)
Frameworks aren't all they're cracked up to be (Score:2)
The thing with frameworks ... is that over time implementation costs increase, and interoperability decreases, as you add more concrete stuff within the framework. They give the illusion of value.
How to kill an article (Score:2)
Fundamental issues in identity. (Score:2, Interesting)
A number of other posts have alluded to 'whats the problem with identity'. In the FWIW department a summary of the important issues from someone who has spent a long time working in the field:
1.) There is no standardized method for defining identity.
2.) Services of value impose the Reciprocal Identity Management (RIM) problem.
With respect to point 1, is your identity?
mdoe
112233
Mary Doe
mdoe@SOMETHING.ORG
http://www.something.org/mary_doe
All of the above 'representational identities' are very
General Reply (Score:4, Informative)
The intent of OpenID (as I read it) is simply to provide an identity. An identity is just a name that at least one person has permission to use, and no more. Multiple people may be able to use the identity. Perhaps some aren't "authorized" (a vague, undefined term in this case), and obtained the credentials by hacking. Maybe one person has a thousand OpenIDs. It really doesn't nail you down, break your anonymity any more than posting with a Slashdot account that has no URL, email, or distinguishing username characteristic, or give the One World Government an ID to tattoo into your arm.
The reason this is useful is that it gives further layering something to talk about. I can't tell my blog system "John Milquetoast Xavier is allowed to post on the front page", because the blog system can't understand "people". It needs "identities". But I can say "this OpenID is allowed to post".
And all the OpenID system will tell me is that some person has authenticated with that ID. I can further restrict their activities; I can still require a CAPTCHA, I can require a paid account, I can do all kinds of things. There's no law that says I have to let everyone with an OpenID have full permissions on my site. (When I say that, it's obvious, but based on the comments clearly some people have this idea in the back of their head.)
I can also go the other way; if your OpenID is from a site that I trust to verify you are a real human for some reason, I might allow OpenIDs from that site more permissions than one from the random internet. If my company sets up an OpenID server that we control and allow only our employees on, I might be able to trust OpenIDs from that server more than random strangers. (Assuming good security for the sake of argument.)
You could set up your own OpenID server to do whatever. I'm sure that if this takes off, there will be OpenID servers that people choose to leave wide open to allow anonymous OpenIDs to be created by anybody. Maybe it'll simply say "Yes, that person exists" to any query with any password, if the API allows it. Using one of those won't tie you to anything.
What you are worried about shouldn't be "identities", you are worried about "identities that can be tied to you". The generic OpenID specification can not provide that, since in the general case the OpenID server could be anything, including a compromised box, and you therefore can not trust it a priori. All it can do is provide a label. Excessive trust in an identity system is the real problem, not an identity system.
I've been creating a weblog for myself lately that includes comment posting, and while I don't think I'm quite ready to jump to OpenID, it's actually exactly what I'm looking for. My spam-control solution will be to moderate every comment posted, but once an identity proves its bona fides, I'll whitelist it. All I want is an identity. I don't really care if I can map it back to a person, I don't care if 10 people are using it, I just want an entity that I can deal with in my database and grant it permissions to above and beyond what an anonymous user gets. OpenID would solve that problem nicely, because I have no intention of farming out to OpenID the question of how much I trust the identity, merely the existence of an identity.
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
Re:so it will be OpenID to bind them (Score:5, Informative)
Or, you know, since it's OpenID and you have complete control over the server, have it set up in such a way that only your IP address can see the password in plain text when you want to log in.
Here's how it works:
You go to a site that uses OpenID. You enter the address of your site to authenticate. You are then redirected to your own website to authenticate (unless you're already logged in.) At this point, the server you set up should ask you if you really want to trust this other site with your identity. You can trust it once and post your new comment, or trust it always if you plan on posting frequently and have that info saved on your server somewhere. Or you can change your mind and not trust it at all.
If you want to implement a password system that nobody can ever figure out, then have it automatically generated and maybe sent to you via email every day in some encrypted format that only you can figure out.
Parent
Re:OT complaint about “ID”. (Score:2)
After all, I wouldn't want anybody to think that "getUserId" returns the part of the user's psyche responsible for ego-gratification behavior.
Re: (Score:2, Funny)
Not as good as the Windows WDM Driver Model.
Re: (Score:2)
Everyone should know that WDM stands for Wavelength Division Multiplexing. Anything else is just silly.