LiveJournal Founder Launches OpenID System

geekdreams writes "Brad Fitzpatrick, the founder of LiveJournal, has launched OpenID, an 'actually distributed identity system' for websites that accept user comments. The system utilizes decentralized servers to authenticate users, and aims to replace centralized ID systems such as Microsoft's Passport and SixApart's TypeKey. The first implementation of OpenID can be seen on LiveJournal comments pages." Previously mentioned on Slashdot, now out of development.

Comments

Re:Not really that good, IMHO.

[Anonymous Coward]

step 11. profit!

Re:Not really that good, IMHO.

[outZider]

Just as an aside, the XML-RPC vulnerability was based on items in the PHP community, and not in the module used within Perl. Danga and the LiveJournal team have been working with XML-RPC for quite some time, and they tend to be nazis about the security of their implementation.

Re:Not really that good, IMHO.

[DJayC]

Tools like Firefox's "remember password" make these kinds of shared identity systems obosolete, don't they? Who cares how many passwords you have to remember? You don't have to remember ANY of them anymore, really.

Not really.. if you aren't remembering passwords, you're pretty much out of luck when you go to another terminal, or forget to backup your firefox directory and lose your data.

Maybe this type of system isn't for you, but I can definitely see some use for it.

Also, just because something is complicated doesn't mean it'll eventually get exploited. Things can be complex, yet well thought out and secure.

Re:Obligatory

[ejdmoo]

No, this is not obligatory. You chose to continue the trend...

*sigh* oh slashdot...

A dupe with a note saying it's a dupe

[m50d]

is still a dupe, especially when the note wasn't part of the actual submission

Re:A dupe with a note saying it's a dupe

[freshman_a]

the previous story reported the system was being developed. this story announces it's launch. i'm not sure about you, but to me "in development" != "in use". so how is this a dupe?

We just need to kill passwords

[Anonymous Coward]

Universal hardware tokens. Please.

Re:We just need to kill passwords

[cjsnell]

I'm kind of surprised that nobody has come up with a good, free alternative to RSA's SecurID system. For those that haven't seen it, it uses little hardware tokens (in the form of keyring fobs or credit card-sized units) that are synchronized with an authentication server. It seems to me like somebody could come up with a similar system that perhaps used a small Java app running on cell phones and PDAs to replace the key fob.

Re:We just need to kill passwords

[B0red At W0rk]

Good only if you never upgrade your hardware and it never breaks down.

Re:We just need to kill passwords

[AuMatar]

1)How do we get the database of who owns what tokens? Talk about a danger of privacy.
2)Easily spoofed
3)Makes identity theft far easier- we now just need to steal 1 number.

Re:We just need to kill passwords

[Professor_UNIX]

It seems to me like somebody could come up with a similar system that perhaps used a small Java app running on cell phones and PDAs to replace the key fob.

Actually that sounds like a pretty good candidate for an open source project. Once you've created the RSA ACE/Server clone you could have someone mass fabricate cheap tokens with replaceable watch batteries. Maybe have them plug in via a USB interface to upload a new encryption seed should it get compromised.

Re:We just need to kill passwords

[CoughDropAddict]

1. Tokens don't imply a database of owners -- it's just a way to prove that you're talking to the same token you talked to yesterday. Instead of asking you to create a username and password for an account with a web site, it would ask you to insert your token.

2. No -- done right, a hardware token would have a private key that never leaves the token. It would authenticate itself by signing challenge data on command.

3. The private key would never leave the device. It would erase its memory if tampering is detected (there are devices that do this today).

Not that bad, either

[jfengel]

The only motivation I can detect for Open Id is to save people FIVE SECONDS by logging into a new forum, website

I'd have thought the motivation was to limit the number of separate accounts you need. Having a billion accounts running around is a massive security nightmare. Either you're using the same password everywhere (and telling every web site owner your password) or you're wandering around with a notebook of thousands of passwords.

Firefox won't remember your password if the computer is a public terminal, or if you use multiple computers (e.g. at home and at work.)

No, this isn't the ultimate solution (which involves encryption, a portable very strong crypto key time-based challenge-response, and perhaps biometrics), but it could be a good half-measure.

Re:Not that bad, either

[Ravatar]

If having 1 billion separate accounts is a nightmare, what is 1 account that has control over all of the same domains?

Re:Not that bad, either

[jfengel]

Put all your eggs in one basket, then make sure it's a really, really good basket.

Re:Not that bad, either

[gooogle]

> I'd have thought the motivation was to limit the number of separate accounts you need.

Yes, log in once to the network and browse on all partner sites without having to log in again.

> Having a billion accounts running around is a massive security nightmare.

Quite the contrary. Having a single point of failure (master account) is much worse.

> Either you're using the same password everywhere

The only way is to educate users about pass phrases and password schemes. Most people who are reading this probably have 3-4 passwords which they use for different sites depending on the security threat. My bank account sites for example all have exclusive passwords. My social software (msn, orkut friendster) have the same password. If you really must, devise a password scheme based on domain name. If your regular pass for example, is mhallwfwwas! (mary had a little lamb whose fleece was white as snow!), then for orkut.com you can use mhallwfwwasou (append all vowels (O and U) in the domain name OrkUt to your password. You can get more creative by appending vowels in reverse order or by interspersing: mOhUallwfwwas, using alternate casing etc).

> (and telling every web site owner your password)

This is a real threat. You have no guarantee that the site owner isn't privvy to your password. This is more an issue of trust than security and in that the proposed system does add some value provided their central servers can be trusted. If you used a password scheme as outlined above, the website owner would not be able to extract mhallwfwwas from mohuallwfwwas (assuming the passphrase does not make sense to him) rendering that password useless to him/her.

Like I said, it's about educating users. I am other geeks have their own set of password'ing rules.

> or you're wandering around with a notebook of thousands of passwords.

Get Password Safe. You may argue that this results in a master password but the software is localized so the threat is smaller (one person gets hacked at a given time; the hack must be local through a key logger or something which is more or less preventable).

Re:Not that bad, either

[rking]

With separate accounts, any web site owner can log into any other web site you have an account on.

But they don't know which sites you have accounts on.

With one account, they don't get your password.

But one web site owner gets not only your password but also a list of all the web sites you connect to (because they all connect to his site) and in some of these schemes he also gets info like you credit card number.

Re:Not that bad, either

[Anonymous Coward]

I'd have thought the motivation was to limit the number of separate accounts you need. Having a billion accounts running around is a massive security nightmare.

OpenID is meant to allow someone to verify they are who they are by using a Web site that is provably owned by that person. Let's say my LiveJournal id is "ANONCoward" and I want to comment on my friend "CmdTaco", whose blog is hosted on GreatestJournal. OpenID lets me log in as AnonCoward at LJ, then comment on CmdTaco's GJ, using an identifier - my Web site address - and a verifier - my LJ cookie.

However, here is the problem I have with OpenID: My ex-girlfriend, who hates me, signs up on LiveJournal with the ID "AN0NCoward" - with a zero. She copies my entries and backdates them, saves my user picture and uploads it to this dummy journal. (This is one mad woman, and this is not a hyperbole.) Before OpenID, she could just spam my LJ friends. With OpenID, she can probably fool some people most of the time, and most people some of the time, into thinking that she really is me - on GreatestJournal, DeadJournal, and, if expansion is as planned, most TypePad/Moving Type blogs, perl.org, and so on.

Granted, this would take some dumb, gullible people on the receiving end of this kind of kindergarten fraud. But we are talking about LJ here.

Not to mention, of course, that comment spam is already showing up, and unlike anonymous comment spam, there's no IP address tracking, or at least none accessible by the spam receiver.

Re:Not that bad, either

[mmkkbb]

You don't have complete control. LiveJournal only allows OpenIDs on comments rather than an entire journal. You can't post to communities or use any of the other LJ features without an actual account.

Re:Not that bad, either

[Nurgled]

Actually, it appears that you can. If I'm not mistaken, logging in there gets you a normal login session at which point you can do anything a normal user can do. The only thing that seems to be disabled is for OpenID users to keep their own journals.

Perhaps they'll lock it down more in the future, though. I've also heard that GreatestJournal gives full access to their photo hosting service to anyone who logs in with OpenID.

Re:Not that bad, either

[spectral]

Except you can run your own OpenID server, and then *gasp* YOU know what sites you connect to. Or, Livejournal knows what sites you connect to (if you use their server), or whatever. NO ONE knows your password, except the OpenID server. NO ONE knows what sites you visited, except the OpenID server. Combine a browser cookie with the OpenID server itself asking you whether or not you want to allow site "www.imgoingtostealyouridentity.com" to have access to verify that you are, in fact, YOU, makes for a pretty safe/secure setup, in my opinion.

Note, also, that OpenID does NOT exchange profile data. OpenID is for Identification. spectral@slashdot.org (if slashdot ran an OpenID server) is guaranteed to be me. There's no information about the man (or woman?) behind the keyboard. It just says "Yup, this is that person".

You have a slashdot account. Why? Why not post everything anonymously? Why not, instead, have one account.. so now you can comment on slashdot, livejournal, the the nytimes website, any of your friends' blog pages (using Movable Type, Blogger, Whatever..), etc... without needing to make an account on each?

This is a GOOD THING.

Re:Not that bad, either

[spectral]

There aren't central servers. This is DECENTRALIZED. Run your own OpenID server. Now you control EVERYTHING about validating that you are you. This does NOTHING else. There is no profile exchange, there is no password exchange. All this does is says that someone using OpenID spectral@slashdot.org (if slashdot ran their own, for example) on Livejournal is the same person that is claiming to be spectral@slashdot.org on slashdot, and spectral@slashdot.org on Deadjournal, and spectral@slashdot.org on any Moveable Type journal, and spectral@slashdot.org on (whatever implements this system).

This is a means of identification. You log in to a site. The site passes off a redirect url, of sorts, to the OpenID server (the part after the @), and asks THEM to verify who you are. The OpenID server does this, and either goes to the URL it was directed to, and now you're 'identified' to the original site, or says no .. and you don't go any further.

So, what if they spoofed the OpenID server, made it always say yes? Then now you have anyone @that_openid_server can ident as anyone else. This doesn't compromise me@some_other_server. I'll probably end up running my own OpenID server, and having my account on it. Or maybe get my friend to, and we'll all share. Small and localized, one password to remember, and works anywhere (home, work, laptop, desktop, friend's house..) and the authentication goes away when I close the browser window.

What, exactly, is wrong with this ... except now I can Identify myself to websites without needing to worry about whether or not they're going to steal my password and try it on every website that's popular?

Re:Not that bad, either

[FLEB]

Exactly. I think the problem that a lot of people have is that this is supposed to be a system for authentication. It's not (from what I've seen). It's supposed to be a system so that you don't have to go through the register/confirm/sign-on whenever you just want to post a comment with your own name on it. It just gives you a consistent signature, and gives site-owners a better way to filter malicious comments without setting up too many hoops.

Re:Not that bad, either

[EvilStein]

"I'd have thought the motivation was to limit the number of separate accounts you need. Having a billion accounts running around is a massive security nightmare. Either you're using the same password everywhere (and telling every web site owner your password) or you're wandering around with a notebook of thousands of passwords."

True, and it's not a half bad idea, but look at the previous attempts at a "shared password" system like Passport, "Adultcheck," and that thing that Sun/etc were pushing. They haven't gone very far yet..

I imagine that this might make some headway in the blogging community, but I dunno about outside of it.

Re:Not that bad, either

[jfengel]

There are some differences between this and Passport. For one thing there's no wallet component. That limits its usefulness, but it also limits the damage (which in turn means that we don't need to be quite so paranoid about it.)

For another it's a distributed (kinda) system rather than a centralized one. The system is actually quite clever; it's basically a way for you to set up your own ID system. You can "shop around" for ID providers. All you really need to own is the URL. If your ID provider goes out of business, you can just get a new one.

True, I don't expect it to go much beyond blogging to start with. But great standards often start as "Hey, let's try this" and then they expand. Yeah, there's a lot of bitching afterwards about "Oh, they didn't think to incorporate X obvious feature" but standards often do much better for organic growth rather than having a central authority's fiat first.

Re:Not that bad, either

[hugesmile]

It's a shame that the first visible post bashed this idea! You clarify it well, except that you use "email-type" format, and really the Open ID's are in URL format. So instead of me@some_other_server, it should be me.some_other_server (substitute a "." where you have the "@").

LiveJournal runs a free service to allow you to be me.livejournal.com (if it's not already taken), *OR* you could use ANY URL you want - presumably a bunch of providers will pop up, and you can use any one you trust... OR put it on your own server, if you run a webserver!

GREAT idea whose time has come!

Re:Not that bad, either

[Nurgled]

I don't see any reason why you can't use it as part of authentication if you want. Just have a list of OpenID identities which are allowed access and let OpenID handle the identity checking step. If the user successfully logs in with an approved identity, you then let them have all of the associated priviledges.

In fact, from what I understand LiveJournal is already doing something like this: users can add OpenID identities to a list which then allows those entities to post comments with a greater level of trust than the default, which is to treat them the same as anonymous commenters.

Re:Not that bad, either

[OhioJoe]

Yeah, one way to recall passwords to sites is exactly as you said, base it off the domain name (only becomes a problem when the web site services are bought by another company and thus change the domain to their parent domain. .i.e., onsale.com to egghead.com, or mailbank.com to netidentity.com) Anyway, one way to do it is pick the same letter deep into the URL, like the 3rd letter or 5th (if a short URL, just go back to the first letter and 'wrap around'). Then, you pick a "radio code". Like the military or Police... A=alpha B=bravo C=Charlie, etc etc... but you use your OWN words.... like use the word apple for every time you come across a domain name that's third letter is "a", and a "borneo" for "b", and so on. Add the same two digit number to each password to make it harder to crack if one were so determined.

Re:Not really that good, IMHO.

[Anonymous Coward]

It's not necessarily about the passwords; would you want someone over on k5 or livejournal posting about their double life with a mistress and a secret cave where they crossdress and watch old Three's Company episodes using your username? "h@@@@@y, I'm mfh and I was jsut wondrin how 1337 i have 2b to g4t ino yor haxxxxxx1ng growp? -- mfh"

It would be easier to identify someone (and harder to spoof someone) if their ID information carried across multiple sites.

Can hardly wait...

[martian67]

I can hardly wait if/when systems like this become popular, to be forced to register an id like Martian5576567567 due to every other numerical possibillity haven been already taken, due to alot of sites using such a system, and people forgetting about passwords or old accounts and re-registering multiple times.

Also isnt there an issue if somone discovers your password, they can "pretend" to be you on any site including sites with sensitive information such as paypal and the like...

Re:Can hardly wait...

[LFS.Morpheus]

I'm not addressing your security issue.. I think OpenID is not designed for secure applications (banks, credit cards, etc) - its more for bloggers, chatters, forums, etc etc.

Anyone can run an identity server.. so for instance each ISP could have one, or you could choose to use Google's, or Yahoo's, or Livejournal's.. or even mine, if I choose to run one for my website. In an ideal world, AOL could run one and integrate it with their AIM logins. Microsoft could run one and then Passports would work too.

Having a decentralized system allows you to avoid problems like this - it's kind of like jabber in my mind. I don't know *too* much about OpenID yet but this is the general idea.

Re:Can hardly wait...

[sharpestmarble]

[cynical]Microsoft run one? I don't believe it.[/cynical]

Oh wait. You said ideal world.

Re:Can hardly wait...

[yincrash]

in openid, you are known as username @ someservice by giving your url at the given service, so unless every person used only one service to sign up with, that wouldn't happen.

for example, I could be mikeyin @ tivoforumB but there could still be someone making posts on the forum i'm from using mikeyin @ wilcofanjournal.

Re:Can hardly wait...

[annodomini]

Did you even glance at TFA? Your identity is not a single word in a flat namespace; your identity is a URL. So you can have foo.com/username, or whatever. Hell, this makes it less likely for you to have to have identities like martian67676, because you can just find a single domain that has your username free, and then use that on every site, rather than having everyone pollute the namespace of every site, which far cuts down the number of available options.

Re:Can hardly wait...

[killjoe]

I liked it better when we all had finger. I am sure some genius will resurect it any day now as the next big thing. Yes it's a decentralized authentication system of sorts.

Re:Can hardly wait...

[stoborrobots]

actually, if this gets popular, and /. buys into the idea, you could then log into anywhere as http://slashdot.org/~martian67 - no need to re-register anywhere else... That's the whole point...

Re:Can hardly wait...

[LFS.Morpheus]

That's interesting... but finger doesn't really have any authentication, does it? You can finger anyone on any system, so pretending to be someone would be simple - finger only tells you if that person exists. Obviously if you have a shell account you have a password but there's no way (through finger anyway) to check to see if that password is correct.

Re:Can hardly wait...

[killjoe]

All finger has to do is to hand out your public key. At which point you can compare the public key the user gave you and the one finger gave you.

Re:Can hardly wait...

[LFS.Morpheus]

Well, then I can get anyone's public key, but I see what you're saying. You could use a public/private key system, asking the user to encrypt or decrypt a random string, and seeing if you can get the same string using the publically available string. I think something akin to backwards RSA (where the private key encrypts) would work better in this case. The only issue is how the user would get their private key, because no one wants to remember a long, random password.

I think its time for me to really go and see how OpenID works. :D

Re:Can hardly wait...

[killjoe]

if you look at ssh keys they are tied to a domain. So I claim to web site X that I am killjoe@slashdot.com and do a key exchange. The site then fingers killjoe@slashdot.com which gives them my public key. The site takes the public key from the finger and encrypts something to send me. I decrypt it and then re-encrypt it using their public key and send it to them. If they get what they gave you then voila, everything is kosher.

Easy, I AM A GENIOUS, behold the next big thing!. It's finger that gives out public keys.

Re:Rivalry

[Ingolfke]

Although he's competing it sounds like he's also willing to cooperate with SixApart

TypeKey -- Centralized registry. Not everybody trusts SixApart to control their identity. (But if you already use TypeKey, there's a good chance a future version of TypeKey will also be an OpenID server... I'm pushing for it at least, and volunteered to do the work.)

and his comments about spam and trust lead one to believe that these are area's SixApart's service could fill.

Re:Not really that good, IMHO.

[diegocgteleline.es]

2 I think the motivation for this service is skewed. The only motivation I can detect for Open Id is to save people FIVE SECONDS by logging into a new forum, website... etc. People already have their own methods to achieve this kind of simplicity in their lives.

3 Tools like Firefox's "remember password" make these kinds of shared identity systems obosolete, don't they? Who cares how many passwords you have to remember? You don't have to remember ANY of them anymore, really.

One of the things I hate about internet is precisely this. Face it, how do you feel when some links in slashdot to a "register for free!" kind of link? I also hate when I go to a blog or a online forum and I'm forced to register, wait for email, login, etc. Most of the time I give up - this thing would fix those problems.

Re:Not really that good, IMHO.

[RetroGeek]

What do I win?

Being modded down?

Re:Not really that good, IMHO.

[Azarael]

For 2, it does get to be a pain when you are signed up to 20 or 30+ forums. Example? these days, a lot of software support and bug reporting facilities are on a forum. It's a bit of waste of time if you have to sign up just to make a couple posts.

I'm not saying that we need more services like the one in the article, but it would be nice to have some sort of simple way to fix this.

A good Idea...

[MaxPowerDJ]

...but a questionable implementation. This is very utopic in nature (not having a centralized server storing everyone's data) but it doesn't feel feasible to just "trust" a decentralized architecture to hold/store my personal information without designing it from the ground up with security in mind.

Just my 2 cents...

Re:A good Idea...

[kurtras]

Did you even read any of the linked materials? No part of the OpenID system stores your personal details. The only thing OpenID does is allow you to prove that you own a URL. There is no such thing as an 'OpenID profile'--an OpenID producer and consumer just don't exchange that kind of information.

And if you read the specs, I think you will see that OpenID is designed from the ground up with security in mind.

Re:A good Idea...

[rayde]

your personal information is stored only with the site you choose for your OpenID. so if you use your maxpowerdj.livejournal.com OpenID to post comments in your friend's deadjournal, only LiveJournal has your information.

Re:Not really that good, IMHO.

[tourettes]

For myself, i don't think it's the fact of having to spend "5 seconds" logging into different sites. I think it's more so the fact of the number of different passwords/usernames i have in use on different forums. For the most part, i try to use the same username/password on most forums, but sometimes my username is taken, or something like that, then i have to try and remember what the username is, etc. I like the idea of this, and hope to use it in the future.

Self Obsessed ID system?

[Anonymous Coward]

If it is like LiveJournal, I am sure lots of self obsessed people will want to use the ID system.

Re:Self Obsessed ID system?

[Ingolfke]

Puhlease. My LiveJournal is my voice to the world, so of course I need to establish my identity as well.

Read my blog about injustice at the Grammy's!

But a dupe with news isn't always a dupe

[jfengel]

It seems to me that "Hey, you can actually go out and download X" is news, even when "Hey, I've got an idea for X" was already news.

Re:Insecure by design

[Anonymous Coward]

And Centralized systems are inherently insecure because your single point of failure is your system. The whole thing can crumble if one mistake is made. You have to build in redundancy and round-robin DNS is simply not redundant for a very large scale.

There are many fun topologies out there like Decentralized Ring (ala Gnutella2; don't knock the design just because the inventor was controversial) which work around issues in simple systems such as Distributed or Centralized. Ultimately your application will decide what the best topology to use is. Authentication is debatable but i've always found it easier to deal with differing systems for different levels of trust in the authentication (for example, to get into your bank 3 levels of authentication would be more ideal than the username and password you use for your Blog, and neither system -needs- to have the same authentication system as the other).

Re:Rivalry

[NetCynicism]

Although he's competing it sounds like he's also willing to cooperate with SixApart

I'm guessing he might be, as he is a SixApart employee since they bought Danga (LiveJournal).

Re:Not really that good, IMHO.

[BlogPope]

I think the motivation for this service is skewed. The only motivation I can detect for Open Id is to save people FIVE SECONDS by logging into a new forum, website... etc. People already have their own methods to achieve this kind of simplicity in their lives.

5 Seconds? Where did you get that benchmark?

I'm a CMS designer,

Ah, that explains it.

If I'm on a computer I trust, I might allow it to save my password. If I run accross a forum that requires a login, I'm more than likely not going to take the time to create a login, just so I can participate. Why? because I've never seen one that only takes 5 seconds. Most send emails, which add considerably more time and pain (I gave up using POP email when I changed my email for the 10th time (@home failed, to be exact).

Not that his solution is perfect and that all of you points are not valid. Just that its not such a bad plan at its core.

Re:useless

[kclittle]

Of course, when I find/steal your wallet, with the tattered but legible cheat-sheet with all your IDs and passwords written down, 'cause you can't keep all fifty of them in your head, I'll bankrupt you in 24 hours.

The point?

[gunpowda]

On the one hand:

Sites that let you enter your name/URL/email/etc and show it without verifying you're you are lame.

On the other:

Somebody could run their own identity server that says they're http://spammer.example.com/000001/ all the way to http://spammer.example.com/999999/ and that's not a goal of this system to prevent.

If anyone can run their own identity server, then why use this rather than a (probably more user-friendly) Captcha system?

Re:The point?

[rayde]

that would involve creating a new account, and having yet another set of usernames and passwords to remember.

Re:The point?

[comwiz56]

The point is so that you can use one identity to comment on multiple blogs, even if they aren't run on the same service. Right now I have a blogger, livejournal, and xanga account, all of which I use solely for commenting. If each of these implemented OpenID, only one would be necessary.

Re:The point?

[jfengel]

Captcha solves a different problem. Captcha proves that you're a human (more or less). OpenID proves that you are you. That doesn't prove that you're a human; it just proves that you know a password. But since you're the only one who knows that password, you're uniquely you and you don't have to create a separate account on each system you visit.

So it's a convenience for users, not to prevent spammers. This does have spam implications: you can blacklist/whitelist ID servers and you don't have to give your email to every site you visit, but it's not really about preventing spam. It's about simplifying the mass of passwords and accounts you have.

Re:The point?

[fastfinge]

Because Captcha systems suck. They are either:
1. so hard that real users are blocked from using the website
2. so easy that a computer program can be written to pass them, or
3. so inconvenient that users can't be bothered to try.

If I come across a post on RandomJoe's weblog, while I may have something valid and interesting to say that RandomJoe and his readers would benefit from, if I have to fill out a form for a new account, perform email verification and pass a captcha, I'm just going to keep my comments to myself. Entering the discussion for most users won't be worth the time.

The solution is probably one of trusted servers; the website in question could choose what open ID producers to trust, and what not to trust.

Re:Not really that good, IMHO.

[Xepo]

First of all, look at the reason this was created. There are hundreds of livejournal clones out there, and a lot of them run the livejournal software (deadjournal, blurty, etc.). I'm not going to create a new journal on each one of those sites just so I can view the friends-only posts of my friends on those sites, and especially not just so I can comment. This provides a way to link all of those sites together, and it does it openly, in a way that sites that don't use LJ's software can use.

Secondly, addressing your remember passwords comment, it's a complete waste of resources for the system for these users, who just may want to leave a comment, to force them to sign up for an account. Why not just let them provide a reference URL which represents them, and let that server verify that the provided URL is the user's?

Many of your points were simply "This is complex", or "This requires relying on more systems", and conclude that it's bad. Firstly, I think 'rely' is the wrong word for this. You're using these other systems, yes, but if these other systems go down, it doesn't stop you from doing anything. It's similar, though not a perfect analogy, to saying that having more IRC servers in a given network is bad because you're relying on more servers.

Also, imagine the advantages this gives when designing around this system. Forums which are really only for one topic, such as an official forum for a specific piece of software, don't even need to store any user or password information (and therefore don't have any sensitive data). The forum can simply store the OpenID URL for the admins and allow anyone who can verify with that URL do all of the admin work.

It's the first step to providing a true roaming profile, and single sign-on for the web, and it's done in an open manner. I think it's a step in the right direction.

Re:Insecure by design

[Ingolfke]

I am in total agreement with you, but such a system would be a frequent target for identity theft attacks. Therefore such a system should have multiple biometric security measures, including fingerprints, DNA, retnal scans, and voice samples.

Such a system would be the foundation of a new set of services as well. For example, if all the citizens of the world would wear a GPS transmitting necklace or under-the-skin implant no one would ever be wrongly accused of a crime or be accidentally lost in the wilderness. With bio-scanning technology the government could ensure that you're vital signs were normal and if they became erratic they could send aid.

Only with a wonderful benevolent government like the United Nations can we ever begin to see the wonders of these technologies and rid ourselves of all the risks of the dangerous ideas of freedom and privacy.

DOA

[NineNine]

Something like this is simply DOA. Few content providers will take advantage of this because they have their own in house and/or have never heard of this guy or his company. If say, Yahoo was to do it, it'd take off like wildfire. But Yahoo's a perfect example... their one id system is and has been in place all throughout their growing universe of web content. As is, does the creator really think that people will be clamoring for one for a blogging site? c'mon... blogging is still quite the ego-centric niche.

Re:DOA

[mdwh2]

There are plenty of LiveJournal clone sites out there (since it's open source, and anyone can set up a server), so simply being able to leave comments on all of these without requiring separate logins would be a good thing - even if no one else supports it. If Yahoo did it, it might be more well known, but I don't see it would be more successful in reality - are there clone Yahoo sites out there? Other blogging systems might have incentive to take up OpenID when millions of existing blogs can use it, but I don't see why other companies would take up a system that Yahoo uses.

blogging is still quite the ego-centric niche.

Well, it's ego-centric to assume that someone can be bothered to sign up for an account just to post comments to what you have to say. This is a step forward to making it no more ego-centric than sending an email or posting on Slashdot.

Re:Not really that good, IMHO.

[rayde]

agreed. and another important factor is, this eliminates the need to register a new account with every blog system out there.. instead you just use the same credentials.

Re:Not really that good, IMHO.

[jasongetsdown]

If I run accross a forum that requires a login, I'm more than likely not going to take the time to create a login, just so I can participate.

Therein lies the real benefit. It essentially means that you are automatically a member of a whole community of forums, or at least trusted enough to leave comments.

But I would imagine you'd still need a new unique account to take full advantage of most sites. You can't have a /. blog for "The guy from xyz.com"

Re:Not really that good, IMHO.

[dustym]

1. Not relevant. It is _not_ complicated. There will be libraries (that do not use eval()) that handle all of that "complicated" (http?) stuff. 2. Five seconds if you have an account. 3. Doesn't give you a single id. 4. Email? DNS? 5. ? 6. Conceded. This isn't targeted at banking applications though, still, it's something to watch for. 7. OK. 8. Once again, it's not foolproof, but it fills a niche. 9. CMS designers are often morons. Get a real job.

Re:Not really that good, IMHO.

[Gaewyn L Knight]

1. if it is a problem... they'll patch it
2. No... it's to save you remembering which login (hmm... was this nick? or email address?) and which password (These !@!#s don't allow periods?)
   
3. Although 'remember password' is nice... how many people truly trust that local database to be secure? Even if you are not paranoid... how many people hate it when they are on another machine that doesn't have it remembered and they can't remember even more passwords because they don't usually use them
   
4. Yes you should always be careful with 3rd parties in trust relationships... however all this service does is lets another site say 'With those credentials I will vouch for them being this person on my site'. It doesn't prove they are Joe with bank account number xxxxxxx... it proves they are someluser@livejournal.com
   
5. Granted... outside systems always leave you open to failures beyond your control. But... it is a ton easier to say 'livejournal users arn't working because livejournal is broken' than saying 'ohh shoot.. we're sorry our database died and we lost all the users'. Both situations will RARELY happen... and if a user can't login cause their verifier sucks they will get a new one.
   
6. The phishing only works if you have their password... which... why would you phish then?
   
7. Nothing comes for free... but I think most users would take 3-5 seconds of lag on first login to save the setup/remember torture
   
8. This system is designed to let you prove you are the user of another system... and it does it securely... this isn't something to use to login to your bank account with... yet... :}
   
9. That infers you are within one CMS...
   
10. There is no #10 ;}
    

11. Profit!!!

[drewzhrodague]

11. Profit!!!

(Sorry, had to!)

What this is actually good for

[ShatteredDream]

Many blogs require you to register in order to be able to comment so that the person who runs them can control trollish behavior. This sort of system is good for letting people avoid having to register to be able to post on dozens of blogs.

Registration is mostly good for keeping away trolls who can't even take the time to learn their native dialect of English well enough to write a coherent and grammatically correct post. Sometimes it's horrifying to read the structure of such posts because you realize how far our schools have fallen. I've gotten ones that if I didn't have a college-level grasp of English, I'd have no idea what was being said.

As long as security is the first priority, this is a good thing. What I wonder though, is how secure this could really be without centralization. The appeal of SixApart's service is that SixApart is guarding it aggressively from being cracked... so who runs this service? I'm not sure how well you could trust a P2P system like this since you have no definitive authority to say "this user is who he/she says they are."

Re:What this is actually good for

[annodomini]

What this is good for is being able to say "I trust comments posted from LiveJournal, SixApart, Yahoo, MSN, Google, and Mac.com users to not be spam." (this isn't a list of places that support this yet, just a random list of large providers that could support it). Then anyone who has an account from those providers can log into your blog and post comments that are authenticated as being from them. Have problem with too much spam from some domain? Blacklist that domain, or remove it from your whitelist. Now, instead of every user who wants to post on your blog having to create a new account, they can just use their account from one of the sites that supports it.

... you have no definitive authority to say "this user is who he/she says they are."

You do have a definitive authority; their identity is a URL, and you ask the server if they really are who they say they are. You do this by going to the URL, looking for a META tag that specifies the identity server to use, and having a talk with that identity server. On LiveJournal, the only major site that actually implements this, your identity is simply the address of your journal, so if your username is foo, your identity would be livejournal.com/~foo (or livejournal.com/users/foo, or foo.livejournal.com if you have a paid account; there is no effort to give everyone a single unique identity). Read the article for the details.

Re:What this is actually good for

[iabervon]

I'm not sure how well you could trust a P2P system like this

"This is not a trust system. Trust requires identity first."

The only thing that this does is that it lets someone who has established an identity use that identity in other places without a relationship between the sites or between the user and the new site. This would let me convince groklaw that I'm http://slashdot.org/~iabervon as effectively as I convince slashdot itself without enabling groklaw to spoof me to other sites (like if I just sent it my slashdot password). It doesn't mean that groklaw should think I'm not a troll just because I've got a slashdot account, but it could, at least, check my latest 24 comments for spelling or moderation, or whatever, and be quite sure that I'm actually the person who made them.

Re:What this is actually good for

[samael]

What I wonder though, is how secure this could really be without centralization.

The protocol has been gone over by a few cypher experts, who seem happy enough with it.

Whether you trust any particular site to be a reasonable validator of accounts is another matter. You might (for instance) allow IBM.com as an authenticator, but not AOL.com, if you thought that getting an aol.com account was too easy.

It's more meant to be so that I can identify myself in various places as being me - you can't trust anyone with an ID to be anything more than _actually_ that ID - it doesn't make them more trustworthy.

Re:What this is actually good for

[mdwh2]

If every douchebag can automatically comment or participate in every site instantly because they no longer have to spend the time or energy filling out a small form and checking their email, the number of inane, useless, spammy, trolling and completely annoying comments and input we're going to have to deal with at a level never before imagined.

Yes, things could even get as bad as here on Slashdot!

(Many places allow anonymous posting which already has this problem. This system is better than that in that it lets you know who is posting, and trolls could be banned anyway - they could only get round that by going through the effort of creating a new account.)

Re:What this is actually good for

[Seumas]

That's actually a good point. On the other hand, while this might be okay for forum type accounts, would you really want to employ it on a site that goes beyond that? Say, an auction site where you want someone to go through more hoops than just punching in some global username? And what about "BugMeNot" style account sharing where people create an account and share it among 500 individuals and each suddenly has access to everything in the world as that "user"?

Re:Insecure by design

[chris_mahan]

And they will conveniently have a full and complete list of "nice people" for whatever re-education program the UN comes up with...

No thanks. I barely trust my government, and I vote for the suckers.

Re:Not really that good, IMHO.

[Shakrai]

One of the things I hate about internet is precisely this. Face it, how do you feel when some links in slashdot to a "register for free!" kind of link? I also hate when I go to a blog or a online forum and I'm forced to register, wait for email, login, etc. Most of the time I give up - this thing would fix those problems.

On the surface you might think that this thing would fix those problems but I highly doubt that it will change anything.

Think about it: If the New York Times wouldn't adopt Microsoft's Passport solution do you really think that they are going to adopt this solution by a (in their eyes) virtual nobody? If something with the backing of the largest software company in the World couldn't take off then I don't hold out much hope for this except perhaps for some blogs here and there -- but that hardly solves the NYT problem.

All that jazz

[FidelCatsro]

About openID
Sometimes i wonder
Why we don't have it shut
Closed ID seems smarter
Burma shave

Seriously all this jazz about the OpenID systems left right and centre from so many sources , yet non of them work , perhaps a new vector is required

Re:Insecure by design

[eno2001]

Bahah!!! I didnt' vote for Bush! Either time! I only trust the governement when they are significantly different from corporations. Currently, the two are synonmous. Corporations are the primary evil and government is secondary unless coopted by corporations which they currently are. So you can't trust anyone. As far as individuals go, they're all corrupt. I don't trust you at all. And you shouldn't trust me. Only non-sentient frameworks are trustworthy. Machines are ultimately the most trustworthy as long as no humans are invovled. Learn about cubic time!! You are all singularity stupid!

Re:Not really that good, IMHO.

[Agoln]

1 I think the motivation for this service is skewed. The only motivation I can detect for Open Id is to save people FIVE SECONDS by logging into a new forum, website... etc. People already have their own methods to achieve this kind of simplicity in their lives.
There are many uses... who really wantes to have to register to 50 sites, just because you wish to post a comment or two, or ask a question at a site?

2 Tools like Firefox's "remember password" make these kinds of shared identity systems obosolete, don't they? Who cares how many passwords you have to remember? You don't have to remember ANY of them anymore, really.
If you are really concious about security, you NEVER use these "I will remember your password..." becuase if someone gets physical access to your system, you are screwed.

3 Caution should be applied when linking with systems using any kind of third party medium. KISS.
How is linking a URL security-prone? You are NOT showing your password to anyone, at anytime.

4 This could be ripe for phishing.
Phishing what? Your ID?

5 This system provides a false sense of security. You will never know exactly who you are dealing with over the internet. Behavioural tests should be part of this system and they are lacking. Also, nobody is going to use a secure pipe at both ends to handle this kind of data, are they? Uh...
Once again, they DO NOT REQUIRE PASSWORDS So why use a secure pipe FOR A URL?

Personally, I belive that this is a great service, and will be welcomed by myself. The genius of the idea, and let me note one last time, the non-need of a password is a key feature of this idea.

It looks vulnerable to spoofing

[karlfr]

On the http://openid.net/ page, it suggests that untrusted websites might popup a login dialog for your own trusted server. That would open a huge hole for man-in-the-middle attacks based on the various browser "url hiding" vulnerabilities. The fact that that behavior is suggested as canonical seems unwise.

Re:It looks vulnerable to spoofing

[HishamMuhammad]

It does not open a hole in the protocol per se. I understand your relevant concern, but people are bashing OpenID so much that I don't think it's advisable to talk about "holes" at this point.

But yes, I agree that popularizing popping up a login to your server is a bad idea, as if people get used to this, that could be prone to phishing -- but not actual man-in-the-middle attacks to the actual OpenID protocol.

Anyway, the way I understand it, OpenID assumes that the user trusts both sites:

I have an OpenID at foo.com, hisham@foo.com. I want to post at randomsite.com, using my OpenID.

If foo.com couldn't be trusted, then foo.com might certify that other people than me are hisham@foo.com.

If randomsite.com can't be trusted, then randomsite.com could just post random crap saying that "hisham@foo.com" posted there.

Still, there are a lot of scenarios where OpenID makes sense: for example "blogger.com says that hisham@livejournal.com wrote xyz". This is the kind of thing that OpenID allows, and I think it's great. The question is if people will "get" this.

Re:It looks vulnerable to spoofing

[CoolQ]

Keep in mind this is a system for authentication, not a system for authorization. You can trick the user into proving their identity, but OpenID doesn't allow you to then access the user's information. It only allows you to verify that they are who they say they are.

--Quentin

Re:It looks vulnerable to spoofing

[CoughDropAddict]

The danger of the attack grandparent describes is that the foreign site could trick you into authenticating with "your home server" by spoofing its login page and hiding the URL to look legit. Then you would be giving your username/password to the untrusted site.

This is a good step

[EriktheGreen]

Taking the items one by one:

1. XML-RPC had a recent exploit that could be revisited in a very nasty way. Even though this appears to use POST, it's still looking pretty complicated from my perspective. I think the same results could be achieved in a much easier way.

So your first argument is that one of the components involved had a security problem? You'd better stop using the internet then, or maybe even your own CMS.

2. I think the motivation for this service is skewed. The only motivation I can detect for Open Id is to save people FIVE SECONDS by logging into a new forum, website... etc. People already have their own methods to achieve this kind of simplicity in their lives.

The end goal of this is much more grandiose. One thing that is both a strength and weakness of the Internet is anonymity. Blanket anonymity has no doubt been a plus for many people over the years, but it's now much more of a problem than it's worth. The Internet in general needs a way for the average user to present credentials to internet services that is automated, fast, and simple. This would be a building block for validation of web sites, e-mail messages, decentralized public key distribution, and a lot of other useful (and badly needed) services. Removal of blanket anonymity (but not elimination of all anonymity) will improve the signal to noise ratio of internet data by several orders of magnitude.

3. Tools like Firefox's "remember password" make these kinds of shared identity systems obosolete, don't they? Who cares how many passwords you have to remember? You don't have to remember ANY of them anymore, really.

That's why that feature of firefox gets disabled by many corporations. It's very insecure. Other options for storing long, non memorable passwords include palm pilots, dedicated password PDAs, and such. They're clunky and sooner or later passwords will become too long to type in anyway. Being able to reference the place to *get* the user's password (along with their encryption settings, public key, etc) is actually more secure.

4. Caution should be applied when linking with systems using any kind of third party medium. KISS.

The Internet is by its nature much more interdependent than you know. It's impossible to do anything online without using at least a few dozen interlinked systems and standards. In general, keeping it simple is a good design rule but it tends to produce simple, monolithic system designs that are unsuited to Internet scale activities. For an example of a large scale distributed service that is as simple as possible on the Internet, check out the DNS design RFC.

5. A system should rely on as few other systems as possible. Minimalism will make a web experience a happy one.

This is an over-generalization. True that dependence on proprietary systems is generally bad because proprietary systems are usually not subject to the public evolutionary process applied to open standards, and therefore can have more problems. In general, simplicity triumphs over complexity when two ways of doing the same work are compared. Complexity wins out if a better (faster, easier) way of doing the work happens to be more complex.

6. This could be ripe for phishing.

I'm presuming you mean people could send e-mails saying "go to this URL". They can do that now. This would actually help with Phishing deterrence if users learned to only trust "verified" e-mail sender identities.

7. Lag. If systems must cooperate, they should do so passively. Most XML-RPC calls, for example, will put the lag on the end-user. This should become a passive cron job or something like it, if it must be used. Make the user "temporarily unverified" until he/she/it can be verified at a later date by an automated process. Let the lag be placed on the system, no

Easy Identification Across Web Sites

[geezusfreeek]

A big reason for me like this (and dislike it at the same time for security reasons) is that with a widely distributed system like this is will make it easier to keep track of who said what, even across multiple web sites. Each person would have the same name across many web sites, so those of us who are involved in multiple online communities can more easily keep track of people that share more than one common community with us. For example, I could identify Slashdot posts by people that go to the iDevGames forums like I do.

Re:Easy Identification Across Web Sites

[geezusfreeek]

And I will now correct myself. It would not do this at all unless web sites started using peoples' IDs from this service as their public IDs.

Re:Not really that good, IMHO.

[psyclone]

[OpenID] hardly solves the NYT problem

Well, assuming this OpenID thing is really great and wonderful and doesn't make the baby jesus cry, then perhaps a lot of small sites will use it. And if a lot of small sites are using it, it might trickle up to a decent amount of medium sites, which might get noticed by a few large sites.

No one liked Passport so that's why it didn't get used. This is a different idea which has a slim, but possible, chance of success.. even on large sites.

public PGP key repository

[lawpoop]

Forgive me if I'm being naive, but couldn't we have more or less open posting if whatever bulletin board system required a PGP encrypted post, and checked it against a central authority, or even several authorities?

Re:public PGP key repository

[Kent Recal]

OpenID could easily be expanded to include an optional feature of linking an OpenID URL to a PGP key, even storing the key.

Well, that would be very backwards.
In fact, the whole OpenID idea is backwards. They basically reinvented finger.

People, get a clue, learn about PGP and use it.
All it takes is a simple plugin for firefox to sign any <textarea>.
The site can then match the keys against the existing public key server infrastructure.

Re:useless

[MrDomino]

this further propagates the idea of centralized identity management.

Christ on a cracker, I know this is Slashdot, but could you at the very least read the summary?

The system utilizes decentralized servers to authenticate users, and aims to replace centralized ID systems such as Microsoft's Passport and SixApart's TypeKey.

Re:A bad idea...

[shmlco]

...allow you to prove that you own a URL.

Actually, as near as I can tell it doesn't "prove" anything. Anyone who learns or knows the URL can pretend to be me on this or any other site. Especially if you're dumb enough to use the subdomain format shown. (e.g. brad.livejournal.com)

Without a private portion (password) it fails at authentication of identity, and devolves to just being "easy"...

NoCatAuth

[HermanAB]

There seems to be quite a proliferation of these services, eg. NoCatAuth, which is used in several projects.

Re:Not really that good, IMHO.

[Guy LeDouche]

Being modded down?

You know him well.

Blogs will be what might save the net!

[ShatteredDream]

Did it ever occur to you, and those like you, that blogs and livejournals have given several hundred thousand Americans (just Americans alone) a new stake in online freedom of speech? The EFF now has a potential base of support from hundreds of thousands of bloggers who don't want the FCC and FEC telling them what they can and cannot say online. That means that online speech is now rapidly becoming a popular issue rather than a "geek issue."

And you want to know what ruins the net even more? Trolls. It doesn't matter where they are rearing their ugly heads, trolls do real damage to any discourse online. If a troll were to talk the way that most of them do in a bar, they'd probably be murdered by having a glass bottle smashed over their head and then get stabbed with the jagged edges. Yet there are tons of trolls out there, and you worry about someone writing a narcistic blog or LJ about their life for their friends? I've only seen a few of that type care if anyone outside their circle of friends and family reads their posts.

And you know what? What makes you think that your comments on slashdot are any different, in principle, from a blog post? How are tons of comments in this forum about natalie portman petrified, and all of the other trollish bullshit not destroying the net just as much? No my friend, the net is just beginning to look more and more like the "offline world."

Re:Blogs will be what might save the net!

[Seumas]

And you know what? What makes you think that your comments on slashdot are any different, in principle, from a blog post?

Because I am posting my comment in response to an article on a semi-news site related to geeks and tech, in which I am interested, just like thousands of other people are doing here. What I am not doing is building a livejournal/blog shrine to myself to glorify my every passing of gas, post pictures of my big toe, share my crappy angsty poetry and indulging in petty on-line livejournal tiffs.

And "free speech" is more than just running your mouth off about random crap and 400 posted "quizes" in a livejournal. "Free speech" is more than just spending your time trying to make yourself seem incredibly cool in a blog so that you can make friends and get people to like you because you don't know how to do it in person.

Re:Blogs will be what might save the net!

[mdwh2]

Funny, all of the journals I read, post and comment on involve discussing things which I find interesting in, just that it tends to be with people I know rather than complete strangers.

If you're going to stereotype journals as you do, then it's just as fair to sterotype Slashdot as a place full of trolls, bad cliched jokes, and geeks with no social skills who have never had a girlfriend.

The difference is, with journals you can simply not read the journals you don't like, where as here you've got to put up with all the rubbish, unless it gets modded down.

Re:Not really that good, IMHO.

[Shakrai]

This is a different idea which has a slim, but possible, chance of success.. even on large sites.

I'll grant slim and possible chance of success. I would certainly welcome it. The pessimist in me thinks it will be a long time before I can forgot about all the fake login information I have created for all those websites.

What I would like to see is a centralized logon system that would contain all of your information (userid/password/real name/address/telephone/etc/etc). Upon activating this logon for a new website you could choose which information to reveal to them. Some websites you might trust enough to give your postal address. Others you probably wouldn't even want to give them your primary e-mail address let alone postal. You could likewise choose whether or not you want to disclose your birthday/ssn/favorite color or what have you.

The big problem with that dream is I would never trust any for-profit company with that amount of information on me. Especially when you think that the only companies with enough name recognition in the industry to pull it off would probably be Verisign (slime) and Microsoft ($). Hardly a great choice now is it?

Re:Not really that good, IMHO.

[kryptkpr]

Face it, how do you feel when some links in slashdot to a "register for free!" kind of link?

Actually, it used to bother the hell out of me.. but now, it BugsMeNot..

Re:A bad idea...

[kurtras]

Actually, as near as I can tell it doesn't "prove" anything. Anyone who learns or knows the URL can pretend to be me on this or any other site. Especially if you're dumb enough to use the subdomain format shown. (e.g. brad.livejournal.com)

Not really. After you enter a URL in an OpenID login box, the OpenID producer will confirm that you've already logged in to the producer site. OpenID is essentially a single sign-on solution. You log in to the producer site once, then you can use your URL to log in to any OpenID consumer site.

Re:Not really that good, IMHO.

[annodomini]

6. The phishing only works if you have their password... which... why would you phish then?

Um, no, that's not true. The way it works is that you go to one site, enter your ID, it redirects you to a page on your identity server asking if you want to allow the other site to verify your identity, and then it redirects you back to the original site. Now, if you weren't already logged in on your identity server, you would have to log in first, so it would redirect you to a login page on your identity server. What's to stop them from redirecting you to a page that looks exactly like your identity server login page, but steals your username and password? Of course, there's no real way to make any sort of distributed identity server work without running into this sort of problem (unless you require people to use certificates stored on their local computer, which doesn't work for the internet kiosk use case). This is the sort of issue that caused microsoft to require you to type Ctrl-Alt-Delete to get to your login screen; otherwise, people could just put up a login screen themselves and grab your login information. On the web, though, there's no real way to deal with this, since you don't have traps like Ctrl-Alt-Delete that are guaranteed to be caught by a trusted party.

I managed to score "Ski Racer" on AOL...

[TheLittleJetson]

You just lack creativity.

Re:I managed to score "Ski Racer" on AOL...

[stoborrobots]

when I get those "pick a username" boxes, I just put any random garbage in there.... so in a moment of creativity, I managed to score "AnyRandomGarbage" on AIM...

ObSimpsons

[sharkey]

Read my blog about injustice at the Grammy's!

Hey!! Don't throw your garbage down here!

Re:Not really that good, IMHO.

[Trejkaz]

2. It takes a little longer than just five seconds to register for a new service. First you have to spend at least five seconds filling out a form and squinting to read the CAPTCHA. Then you have to wait a few minutes for the email to finally arrive and then confirm it. Of course, I'm only talking about the majority of services here. Clearly there are one or two (total) services in the world which actually take five seconds to sign up for.

Furthermore, that's not the only reason they did it. Suppose John Smith registers on 5,000 web sites. What says that JohnSmith at Slashdot is the same john_smith at LiveJournal? OpenID solves that part of the problem.

3. Last I checked, Firefox's "remember password" feature didn't help my home browser remember passwords entered at work. Furthermore, this feature doesn't magically register new accounts either.

4. I agree, and not having to register on 5,000 web sites is minimalism for most people.

6. If you'd bothered to read their documentation, they actually admit that rogue sites can do whatever they want, including simply not handling the OpenID information at all. What OpenID does is makes sure that sites which _do_ play by the rules have a consistent view of identity.

7. I'm sure most users would love to have to manage a cron job just to do something that web sites can do for them.

9. Let's see how.

Interesting

[pHatidic]

Providing you actually have a URL, this may be slightly better than the existing typekey technology. However, only 1 in 14 internet users has their own blog or website. The more options the better I suppose, but this is really an evolutionary step rather than a revolutionary one.

Universal Authentication?

[utopicillusion]

I am treading out in unknown terriroty here, but is it not possible to use some authentication mechanism on a central server, and verify it, u know like Kerberos/Passport/alternative? Or is open-id trying to do exactly that?

Re:A bad idea...

[CoughDropAddict]

You're right! In his pages and pages of specs, he totally missed the attack of "just typing someone else's URL!" I wonder why he never thought of that!

Thank you for your thoughtful analysis.

Re:Not really that good, IMHO.

[spectral]

That is precisely what OpenID isn't. They mentioned that there's no profile exchange.. OpenID just makes sure that shakrai@slashdot.org is that person. Doesn't say anything ABOUT that person.

They wanted ot keep the protocol simple and easy. Another layer can be added on top of it, later on, for profile exchange.. but they specifically avoided doing it in this version.

The problem with profile exchange is, it's hard to maintain. Once you give them information, they can keep it. If you only give them an OpenID, that's all they know about you, unless you give them more. Which most sites will probably ask for anyway. I'm sure the NYTimes wants you to login for demographics, not because they want to verify that you are who you say you are before you read a story. They have no way of knowing anything about shakrai@slashdot.org, besides what you visit. But if you make an account there, they have your name, address, age, gender, etc. AND what you visit at their site .. OpenID is not meant for this.

Re:Not really that good, IMHO.

[spectral]

What makes me sure that my identity server is mine? I check the URL. If it doesn't say @spectralsdomain.com , then I know it's fake. If it's in bold green text, shows my own personal graphics, and says that, then I can be pretty damned sure it'll be my own.

So, what's the danger here? Idiots will log in to a site they don't need to be in, get their identity and openid password stolen, and then go running around logging in to all these sites and leaving comments as you.. where every single time they login, is logged by your identity server...

the first time I see a login for slutty_porn_chat.com using my ID, I'll know my password has been compromised, change it, and bam.. I'm secure again. Whereas if I need to signup for this evil site, and am stupid enough to give them a password I normally use (since I use the same everywhere), then they have my password to everything.

Keep the password the same on all sites you trust (if you're lazy, like me). keep the OpenID password different (if you're uber paranoid). Now you have two passwords to remember, but very little worries about anything. Right?

Self-Identification

[Downes]

A few days before the LiveJournal system came out I released something very similar (this is not sour grapes; they have very generously acknowledged my work) called mIDm. You can view it here: http://www.downes.ca/idme.htm

I was very pleased to see the LiveJournal system because it acknowledges what no system has done before: that identity belongs in the hands of the users.

This has two major aspects:

First, as argued over and over on the LiveJournal site, this is not an authentication system, it is an identification system. You are not being required to prove you are who you say you are, you are instead being given a mechanism to declare who you are.

It is, in purpose and intent, as secure - and no more secure - than filling out a web form. But the idea here is that you fill out the form just once, and then using a system of call-backs (to ensure your personal information isn't spoofed) you can use that information anywhere on the web.

Let me repeat that, in case you didn't get it: anywhere on the web.

The idea is, if you want, you can have the *same* identity on each of dozens of websites. Which means, say, if your email address changes, you change it once, and this information is now available (if you want it to be) to all of your accounts. Ditto your home page.

I will leave the many many applications - such as web-wide peprsonalized display, in-page messaging, multi-site social networking, and more - as an exercise to the reader.

Second, what it means is that the system is distributed. This means that there isn't some centralized grand poobah of identity (the way Passport tried to be, the way Sxip is trying to be). It means you can choose any system you want to host your identity or you can build your own.

Let me repeat that: you can build your own.

Don't like their security. Make yours tighter. Too much lag on LJ. Host it yourself. Want to send different emails to different types of site. Code it.

One of the mistakes made in previous system was in the use of a one-size fits all model, which meant that the level of security had to be at the highest possible - which is orders of magnitude more than someone needs merely to write blog posts and comments. Building a distributed system allows each person to decide how much - or how - security is appropriate.

Having made these two points, I would like to mention briefly where my system goes beyond LJ's. In their system, you are still typing your home URL at each site you visit. In mine, you don't ever have to type your home URL - it is stashed in the browser agent environment variable, where it can be picked up by any site that needs it. Oh I know, you probably shouldn't do that - but I've been testing this for months with no ill effects. YMMV, and if you have a better idea, I'm all ears.

Despite the naysayers here on Slash, this system - or something very like it - will become the norm on the internet very soon.

Why?

- Because it will be very simple to install for websites, especially after things like Drupal and Wordpress modules are built.

- Because it will be very simple for the user, because they just need to type one thing in (or extensions will be built for my type of system).

- Because it will work.

- because it will be no less safe, and probably more safe, than filling forms willy-nilly everywhere you go.

xdi.org and I-Names??

[YakumoFuji]

this sounds like the stuff XDI.org do. with i-names and so on...

Re:Not really that good, IMHO.

[metamatic]

Passport failed because it required that everyone trust Microsoft.

(Yeah, right.)

This system doesn't require a central trusted entity.

Sold!

[ender-]

Ok I'm sold! I already thought it was a good idea, but the best part is, if you are worried about the stability of an OpenID server [and want your personal URL] it is convenient even if you don't have the ability to run your own OpenID server! You can just DELEGATE! Enter your personal URL, but it will do the actual identification from whatever OpenID server you point it to [say livejournal]. That way, if LJ [or your chosen OpenID server] goes away, you simply change your delegation to point to another OpenID server [where you will need an account of course], but you will still have your own URL as your identity. You don't have to change it just because your OpenID server doesn't exist anymore. Very nice!

Taking it a step further

[HishamMuhammad]

What if we took this idea a step further and added a form of authentication, namely, signing of messages?

Here's what I have in mind, please point out any flaws in my logic:

• I log into livejournal.com using my id, "hisham".
• I post a message at foo.com using my OpenID, hisham@livejournal.com.
• foo.com sets a cookie in my browser, and issues a request to livejournal.com, with the cookie and the message.
• livejournal.com receives the request, verifies the cookie (confirming that the request from foo.com was posted by a browser who's actually currently logged as hisham in livejournal).
• livejournal.com then signs the message and sends the signature back to foo.com.
• foo.com posts the message saying that hisham@livejournal.com posted it, with the signature in the end (or most likely, accessible through a link).
• If anybody wants to verify if the message is legit, they can copy-paste the message and the signature and check it in a verification form in livejournal.com.

The system is still fully decentralized (anyone can host their own "OpenAuth" servers) and you only need to trust one of the sites (the signer), not both as in OpenID (though "trust" in the sense of OpenID means just identification, not authentication -- and I'm fine with it since that's its purpose).

Off the top of my head, the only two potential issues I see are:

• the signer server would see everything you posted anywhere -- but anyway, Google see all my emails... if this is a concern, host your own server;
• the load on the servers -- would this be a big problem? most sites could use lighter, less CPU-intensive cryptography... again, if this is a concern, host your own server with 1024-bit crypto.

What do you people think? Could something like this work??

Re:A bad idea...

[shmlco]

...then you can use your URL to log in to any OpenID consumer site.

Which is the problem. It doesn't need to be your URL.

My current comments stand, with a couple of exceptions. First, it appears that you have to "authorize" a site. Second, you have to be logged in.

Given those two conditions, it appears I could easily impersonate someone on a site they frequent if they have a session running AND if I know (from their sig, perhaps) their URL/domain.

read the spec, dude

[CoughDropAddict]

I recommend you take the time to read and understand a spec if you are going to claim it is broken in blatantly obvious ways.

Step 5: Consumer checks the identity, via the User-Agent

Now the consumer constructs a URL to the identity server's openid.mode=checkid_immediate (or checkid_setup) URLs and sends the User-Agent there. By sending the User-Agent there, the user's cookies and whatever other login credentials are sent back to their trusted identity server. The server does its work, appends its response onto your supplied return_to URL, and sends the user-agent back at you.

Breaking that down:

1. Say your home URL is www.slashdot.org/~shmlco. You log into slashdot.org, and slashdot gives you a cookie as it always does. This is how slashdot verifies you are logged in.

2. You go to randomblog.com. You want to post a comment as shmlco from slashdot. So you give randomblog.com your URL, www.slashdot.org/~shmlco.

3. randomblog.com establishes a shared secret with slashdot.org cryptograhically, if it has not done so already.

4. randomblog.com sends your browser to whatever authentication URL is specified in the link tag of your site, for example: <link rel="openid.server" href="http://www.slashdot.org/openid-validate.cgi" >

5. Your browser hits www.slashdot.org/openid-validate.cgi, which can validate that you are logged into www.slashdot.org (just like any slashdot page can), based on your cookies.

6. If you are logged in, slashdot.org signs a certificate saying so, using the shared secret as a key, and redirects you to someblog.com with the signed certificate as one of the parameters.

7. someblog.com decrypts the certificate, and therefore knows that your browser is signed into slashdot.org.

As you can see, your proposed attack could not work, because you don't have the victim's cookies in your browser, nor do you have the shared secret you would need to fabricate a certificate.

I mean really, don't you think that someone who took the time to write a detailed spec would think of obvious attacks like the one you propose?

Re:read the spec, dude

[shmlco]

I appreciate the detailed explanation, but I had to chuckle at the last line. I've seen plenty of "detailed spec's" that had rather large, freight-train-sized holes in them...

Problems with OpenId

[Atrus5]

I've expounded on why OpenID is insecure and I believe it is unnecessarily complicated.

Problems with OpenIDI put off reading the OpenID spec because I though it was probably flawed. Now I just feel applying my head to my desk.

OpenID is led by with this philosophy:

The point of OpenID is to be dead simple, short-comings and all, so it's actually adopted.

The above is taken from a discussion of vulnerabilities. The problem with this lowest common denominator approach is that it's horribly broken. OpenID is currently no better than just giving the URL of your blog.

The number one problem is the complete lack of integrity checking. Everything in OpenID seems to be perfectly happy to let their requests be modified in transit. I think the problem with this are pretty damn obvious: nothing can be trusted. Fortunately, fixing this is pretty simple: use TLS. In today's shared hosting environment, you probably want to require support for server name indication.

Another brilliant idea: transmit the key that you'll use for signing later in plaintext.

Yes, you can ask for DH-SHA1 encryption and get back a plaintext secret. If this troubles you, don't use the handle and instead use dumb mode with that server. (and if somebody sniffed the plaintext secret, it won't matter, since you'll never accept queries using that assoc_handle). If the server can't do DH, it's probably limited in some way, but using dumb mode is still safe, if not a little slower.

I believe "limited in some way" means "completely insecure." "Dumb mode" is not safe because there's no key associated with the server, so there's no way to ensure you're talking to the same one or that someone isn't tampering.

I also don't see much point in using a symmetric key for speed and security when you're just encrypting a short string. It's so tiny that both improvements are similarly small.

Perhaps the biggest problem with OpenID is it's reliance on sending a user to another page to login. It's just too easy to spoof a page and fool most people. Even better, you can open a window using Javascript and hide the location bar. Even if you normally use TLS, most people probably won't notice if it's missing or the certificate is different. Also, most sites (including LiveJournal) include a completely insecure assurance that you're secure. For example, LiveJournal says "LiveJournal Secure Site "

A simpler and more secure alternativeThe only way to fix this is (gasp) get users to carry their own keys. If you stored your key in a bookmarklet or extension, you could sign something with it. This is completely feasible because Javascript cryptography implementation is done. You could submit your public key with the signed comment. If you wanted to associate yourself with a URL, all you need to do is link to a page with the public key. If the same public key can be used for the signature.. That's right, no special identity server is needed. The public key could be submitted directly or it can be linked to. It might be a pain to write out the entire URL to the key, so perhaps autodiscovery-from-HTML should be supported:
<link rel="openpgp.key" href="http://www.livejournal.com/pubkey.bml?user=a trustheotaku" />
Note that no TLS is needed. The signature is secure in and of itself. If you want to support all the fanciness (e.g. revocation) of OpenPGP (spec), then you just need the

Hmmmm

[flink]

So one could almost say that it's like a passport that allows you to "log on" to lots of different sites...

solution - iButton

[Harald Paulsen]

One sollution would be the iButton

How does this prevent you from saying you're me?

[Poromenos1]

How does this prevent me from saying I'm, for example, the previous user that posted a comment? He has his server set to trust the site I am posting on, and I'm using his name, so shouldn't the server accept my comment, since it doesn't know who's posting? I know this is not supposed an authentication scheme, but an identification scheme where everyone can claim to be anyone else isn't that good, IMO.

Re:Not really that good, IMHO.

[stoborrobots]

If I were implementing an identity server, in order to prevent phishing like this I would not have the identity server ask for a login during the middle step... (the way I read the spec, it's not meant to...)

Instead, I'd have the identity server return "not logged in", and make people log in to the identity server first, separately. This is for people like me, who log into slashdot first thing in the morning, then proceed to visit other sites during the day... I'm already logged in to slashdot, so it can validate my id without needing to give me a login box.

PGP keys provide trusted ID, and far better

[Morgaine]

A new scheme for this is actually pointless, because it just reinvents an existing wheel and does so far less effectively than before.

That previously invented wheel is PGP keys.

They were created for a different purpose, but they already contain a string that can be used as a legible identifier (which commonly contains a URL or email address), and they are trivially checked, and they are vastly more proven and secure as a means of trusted identification, and they already operate through a distributed system of public keyservers, and there is already a huge web of trust built around them, and of course OpenPGP and GnuPG are already fully free and open systems.

So why reinvent a wheel, and badly? Use PGP keys for login recognition, and any security concerns just evaporate.

Re:PGP keys provide trusted ID, and far better

[geekdreams]

Because whatever system is used must appeal to the average user, and I don't think the average user understands PGP keys. (I'm not even sure I understand them... How would implement PGP on a site like Livejournal, for example?)

Re:We don't need single sign-on!!!!!!

[mdwh2]

We don't need single sign-on to fill in a few form fields for banking, ecommerce, or blogs. The risks-to-benefit ratio just never works out. Its a few fucking form fields for Christ's sake!

Says the person who couldn't even be bothered to sign up to Slashdot...

Re:Not really that good, IMHO.

[spectral]

Hmm. it might do that, I'm not entirely sure. I've not actually used it, I just really like the concept. :)

Re:Not really that good, IMHO.

[stoborrobots]

Heh - yeah, me too... that was an oops on my part - that was supposed to be a reply to the post above yours...

Re:No

[mdwh2]

Take a look at the typical LJ and you will see that it matches the sterotype given to it very well. LJ's are not the pinnacle of individual expression. Sorry. I'm sure there are a few "good" ones there, but they do not represent a majority that ShatteredDreams thinks he can count on to "save the net".

There's a lot of boring and rubbish journals; but I'm not convinced that the noise ratio is any worse than the trolls on Slashdot.

Futhermore, if you think that people sit around reading LJs at random, then you are *completely* missing the point. The idea is that you read and comment on the journals of people you know, like and/or find interesting. Who cares if there are a million rubbish journals out there if you don't have to read them?

Blogs in general are not very good sources of high quality information or discussion. I'll stick to my favorite professors, writers, and other authors over the vast majority of the blogs out there.

And what if one of your favourite writers was writing on an LJ?

Replace "blogs" with "websites", and what you say is still true: the vast majority are rubbish. So by your logic, websites in general are no good.

Re:How does this prevent you from saying you're me

[Poromenos1]

Ah, I see now, I must have missed that in the spec, thanks. :)