Slashdot Mirror
AOL Now Supports OpenID
Nurgled writes "On Sunday John Panzer announced that AOL now has experimental OpenID server support. This means that every AOL user now has an OpenID identifier. OpenID is a decentralized cross-site authentication system which has been growing in popularity over the last few months. AOL is the first large provider to offer OpenID services, and though they do not currently accept logins to their services with OpenID identifiers from elsewhere, they are apparently working on it. The next big challenge for OpenID proponents is teaching AOL's userbase how to make use of this new technology."
People who don't want to manage 5000+ usernames.
Single sign-on across the internet is a bad idea. As more sites require it, people's web browsing habits will be tracked on an unprecedented scale. Seriously, what benefit does it provide? I certainly don't want to log onto my bank's website automatically. And in general, I don't want to reveal anything about my identity unless there is a very good reason to do so. The whole purpose of OpenID and similar technologies is to make it easier to track people. This is not the way I want the internet to develop.
It's a last ditch effort by AOL to stay relevant to the rest of the InterWebs.
Signature applied for, Patent Pending
One major problem I see with this sort of initiative is spoofing of your provider's sign-in page. Unlike spoofing in its current form, if someone was able to get the password for your OpenID provider, he'll have access to every single one of the accounts you've used that ID with. It's putting all your eggs in one basket -- with the way everything is currently handled, your sign-on information to an individual site may be compromised, but you won't lose everything else.
Is there a solution to this kind of problem, or is OpenID really only targeted to low-risk authentication; i.e., for forums and social networking sites?
No comment.
OpenID is the phisher's dream. I honestly don't get what would motivate someone to implement this specification.
When I worked at the library, a majority of the tweens and teens came in just to check/update their MySpace. they didn't even have a computer at home.
"We need to get over this notion, that, for Apple to win... Microsoft must lose." - Steve Jobs, 1997
I am TheRaven on Soylent News
"OpenID is a simple single sign-on mechanism advanced by Brad Fitzpatrick of LiveJournal. In OpenID, your identity is a URL." - http://en.wikipedia.org/wiki/OpenID
Basically, OpenID provides for distributed authentication.
IMO, what makes OpenID interesting is that in the 2.0 protocol, XRI (i-names) have been included, which opens the door to enabling selective, authenticated authorization of access to services, be it as simple as the ability to contact me (I would allow any parent of a child in my kid's pre-school class to phone me) or as complicated (eventually) as any contract you can imagine.
OpenPrivacy, on the other hand, assumes such services as a starting point, which is why I suspended development of OpenPrivacy in 2002 and began working on XRI/i-names. OpenPrivacy will use sophisticated techniques such as zero-knowledge proofs to enable distributed reputation providers and truly pseudonymous identities that cannot be traced to their owner (unless such verification is mutually requested), but it requires strong, secure identity as a starting point.
I look forward to creating grassroots i-names-enabled communities soon (starting in March, if all goes well) and eventually getting back to my OpenPrivacy roots - which is where (IMO) things start getting really interesting.
The antidote for misuse of freedom of speech is more freedom of speech.
-- Molly Ivins
If you don't want to be tracked, don't use OpenID.
If I go to a blog and enter a comment with the name Kelly Clowers and give my website as www.clowersnet.net/~krc/, how do you know that I am really the Kelly Clowers who owns that website? This example is one of the original use cases for OpenID.
Now anyone can google Kelly Clowers and if an OpenID post turns up in the results, you can be fairly sure it was really the owner of www.clowersnet.net/~krc/ (which is presumably me, since that website specifically mentions this account (which is a solution that can work for main accounts, but I don't really want to list every one-off comment I ever made on random blogs)). Of course, a page could be hijacked, but the point is that imitating someone is not as trivial as entering someone else's name and website.
Not being tracked when you don't want to be tracked could be an issue if websites started accepting *only* OpenID, but I haven't seen anyone do that yet, and I doubt many will ever do that. And I don't think OpenID is really intended for online banking and shopping and the like. Also, if you don't want to be tracked, you could set up a second OpenID account that does not link to your primary account or to your real name.
Climate Progress - Hell and High Water
These sorts of abbreviations are often idiomatic and literally incoherent. For example, "PIN" stands for "Personal Identification Number", but it doesn't actually identify you; the account number identifies you, and the PIN authenticates you (if you were to type your PIN into a terminal without putting in a card, it would have no idea who you were). So, if people have to ignore part of the expansion to understand the term, it makes sense that they'd ignore the whole expansion, and then want a simple noun to say what they're talking about. And, of course, the last word of the expansion is a noun that sticks in people's heads as being related.
Also, in the case of TCBY, "TCBY" is actually a company, not yogurt. For that matter, using the abbreviation as if it were the expansion would be very strange; you'd have to say "I bought some of TCBY", because "I bought some the country's best yogurt" is clearly ungrammatical. If you're ignoring the fact that it starts with "the", you have to ignore the fact that it ends with "yogurt", too, and treat the term as unanalyzable.
"I bought some of TCBY" makes sense, you're just talking about stocks...
You get that the whole point is to have a "single sign on," right? And that the problem with Passport is that there is only one possible provider (Microsoft)? OpenID lets anyone be the identity provider. If you want your email to be your signon, just ask your email provider to support openID. It's can only be good news if large sites with lots of users become openID identity providers rather than each company developing their own identity system.
MRSH-Recording device, corned beef sandwich with kraut, seafaring bird, and the foamy top of a beverage.