Why use OpenID?

I recently imple­mented OpenID on billso.com. OpenID is a sin­gle sign-on (SSO) sys­tem that lets web users log on to mul­ti­ple sites with the same user­name and pass­word. SSO sup­port is becom­ing a key suc­cess fac­tor for social net­work­ing and social media web sites, as new users strug­gle to man­age a grow­ing num­ber of passwords.

With OpenID, no one needs to apply for a user account on billso.com. They can use their user­name and cre­den­tials from another site to join billso.com, or to post a com­ment on a billso.com article.

Kyle Neath posted a long rant about OpenID yes­ter­day. He won’t be imple­ment­ing OpenID on his site because he thinks the sys­tem too con­fus­ing for users. I don’t think OpenID is that dif­fi­cult to under­stand — here are two brief expla­na­tions from OpenID.net and Wikipedia.

Phish­ing phears

Kyle’s con­cerned that phish­ers might tar­get OpenID users, and he uses Pay­Pal as an exam­ple. That site has become a pri­mary tar­get for phish­ing attacks.

OpenID does have an iden­tity sys­tem that lets an autho­rized user revoke their OpenID as a last resort. Any­one who uses an OpenID should select a strong passphrase, as I described in this billso.com arti­cle from 24 Aprill 2008. OpenID can also add mul­ti­fac­tor authen­ti­ca­tion to their ser­vice. Check­ing a user’s loca­tion, or ask­ing for a token or passphrase that only the user should have, in addi­tion to the reg­u­lar passphrase, would pro­vide a strong defense against phish­ers. Vir­tual key­boards and other sys­tems could also be used, as I described in this billso.com arti­cle from 17 April 2008.

The provider’s burden

I under­stand some of Kyle’s points. Any web site that imple­ments OpenID for SSO could also become a provider of OpenIDs. I decided not to do this right from the start. I don’t want to pro­vide per­pet­ual sup­port users who request a billso.com OpenID user­name. There is a sys­tem that lets depart­ing OpenID providers del­e­gate their users to another provider.

On 30 April 2008, I posted some pro­gram­ming code that lets a pop­u­lar Word­Press OpenID plu­gin use JanRain’s ID Selec­tor tool. There are sev­eral providers of OpenIDs that can carry the long-term bur­den of main­tain­ing these accounts, includ­ing VeriSign, AOL, Google, Flickr, and WordPress.com.

Uni­ver­si­ties could become OpenID providers. It makes sense to give stu­dents and employ­ees access to a global SSO sys­tem, as long as schools are will­ing to pro­vide sta­ble, per­ma­nent user­names for their stakeholders.

Users can also pur­chase a per­sonal iden­tity domain for around US$10 a year and get a per­son­al­ized OpenID URL.

Related posts and pages from billso.com

• OpenID
• 30 April 2008: Updat­ing WP-OpenID to sup­port ID Selector
• 24 April 2008: Change that pass­word into a passphrase
• 17 April 2008: Vir­tual key­boards and mon­i­tor­ing soft­ware foil key­stroke loggers
• 12 April 2008: Find­ing busi­ness con­tacts and pass­words on the Internet
• 14 March 2008: Social media in action
• 2 July 2007: CXOs face mal­ware email attacks
• 11 Jan­u­ary 2007: How to cre­ate a secure password

Tagged as: authentication, crime, key-success-factors, openid, phishing, security, student, university, WordPress