Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Case for OpenID

Posted by Zonk on from the halt-and-identify-yourself dept.

An anonymous reader writes "VeriSign and NetMesh are making the case for OpenID, the grass-roots, decentralized digital identity system already supported by LiveJournal, Six Apart, Technorati, VeriSign and many startups, reportedly growing 5% every single week. They say OpenID 'is fundamentally different from other identity technologies' because it is a 'fully decentralized system' and has a 'much lighter cost structure' than any alternative, like Microsoft Passport, CardSpace or Liberty Alliance. Time to remove username and password from your site and add OpenID libraries instead, so visitors can authenticate with their blog URL?" From the article: "If tomorrow, for example, you decide you don't like the Diffie-Hellman cryptographic key exchange at the root of OpenID authentication, you can develop your own way of authenticating, and deploy it within the OpenID framework. If you have an idea for a new identity-related service that nobody else ever thought of, you can deploy it into the OpenID framework as soon as your code is ready. This radical decentralization on all levels of the stack, both technically and organizationally, is a very strong catalyst for attracting innovators and their innovations. This makes OpenID a superior choice for identity-related innovation."

5 of 229 comments (clear)

  1. No way! by Anonymous Coward · · Score: 4, Insightful
    Time to remove username and password from your site and add OpenID libraries instead, so visitors can authenticate with their blog URL?

    Urgh, no way! I do not want all my identities to be tied together through one system. My actions on one site should in no way, shape or form be able to be tied in with what I do on other sites. Compartmentalizing my online life is the best remaining way to remain a modicum of privacy and stave off easy identity theft.

    Any website switching to openID exclusively will lose my business. (Of course, if they offer it in addition to a standalone u/p, I'm fine with that, although I do fear that once it gets enough momentum, the standalone u/p will disappear after all.) :/

    1. Re:No way! by Silverstrike · · Score: 4, Insightful
      That's not the point.

      As the GP said, you CAN make multiple identities. For example, make a "blog-posting" account, and use it to Authenticate to all the blogs in which you want to post. Use it to login to other "annoyance" login websites.

      Then make a seperate one for your bank, your credit cards, etc.

      The beauty of this system is that its a superclass of the current model -- it has all the capabilities of the established model, plus some more functionality.

  2. I've always liked the IDEA of OpenID by lidocaineus · · Score: 3, Insightful

    ...but there's no real easy server implementation on Linux (or any other OS) that doesn't require you to do a decent amount of interfacing with the libraries. In other words, if you have time, it works great (ie, your employer wants you to work on an OpenID implementation project). If you just want to host some IDs on your personal box, there's no easy drop-in server software, or even reference software; my non-coder friends can't even begin to use it. I mean even Jabber has jabberd that you can build on.

    Anyway I'm sure that'll change in the future, but it'd be nice to have now. Or maybe I'm completely blind and there's a reference server implementation hanging around somewhere?

  3. Can't be too complicated by a_nonamiss · · Score: 3, Insightful

    It's all well and good that I can write my own implementation of Diffie-Hellman key exchange, but if my mother can't go to a site and quickly and easily create a login, it's not going to work. I'm not at all saying it's a bad idea. Technically, it's a wonderful idea, but it has to be made so simple that anyone can access it, otherwise people are going to continue to use stupid services list Microsoft Passport.

    --
    -Arthur
    Cave ne ante ullas catapultas ambules
  4. Re:OpenID is great in theory by Elyas · · Score: 3, Insightful

    Actually, that's really only true if you go about it by trying to "find" the bad users.

    If you want, instead, to look for good, legitimate users with regular useage patterns, the only thing you need is the data and a single sign-on distributed across the systems. You make it easy to get a bad reputation, and hard to get a good one, just like real life. Then voting systems can more heavily favour the consistently useful users, etc.

    Finding the bad guys is whackamole, and useless :)