Justin Dugger

The One True OpenID configuration

I like the OpenID concept, but by now it's clear that there's far more Issuing Parties than Relying Parties. In layman's terms, there's more sites that want you to use your account with them on other sites than sites that let use an account from elsewhere. Which defeats the whole point in dramatic fashion. The Password Thicket: Technical and Market Failures in Human Authentication on the Web [via Bruce Schneier] examines the marketplace and offers the following conclusion:

In the meantime, this perspective supports the claim [15] that deployment of an open, federated identity protocol such as OpenID will be opposed by current stakeholders on the web. Federated login not only removes sites’ pretext for collecting personal data but their ability to establish a trusted relationship with users.

This is only the most recent accusation, as the citation indicates. And there's plenty of economic incentive to refuse OpenID; you'll have no pretext for asking for email addresses or Favorite Movie 'security questions' that will help you sell targeted advertising. But there's another reason OpenID is struggling in the marketplace that isn't mentioned: OpenID is hard for users to deploy correctly. There is One True Way to configure your OpenID safely, which I will document for myself and posterity:

Buy a domain name. This domain is your openID.
Find some hosting for this domain. Preferably with exclusive access so only you can modify it.
Purchase and install an SSL certificate for your domain.
Locate or install an authentication system that supports OpenID
On the page accessible on your domain, place an OpenID delegate relation link to that authentication system.
Make sure both your OpenID URL and the delegate use HTTPS and are invulnerable to the cornucopia of web attacks.
Cry as you realize that few of the OpenID providers you could have delegated to will accept your OpenID.

Skip any of these steps and there is a world of pain waiting for you. And there's plenty of smart people who miss important points. If you don't buy a domain and just use a site like LiveJournal or Gmail directly, you're at the mercy of your provider's implementation and longevity. If you need a real example, provider Vidoop gave people a real scare.

Reviewing the steps above, it's obvious why Verisign was an early partner with OpenID; they had a lot to gain up until their expert jumped ship for Facebook.

Other articles

Bruce Schneier deserved to lose

Sat 19 June 2010

NPR held and broadcasted a debate on the resolution, "The cyber war threat has been grossly exaggerated," and invited a sophisticated panel to debate for and against it. The format of Intelligence2 debates is two panels of speakers competing to change the audience opinion. So even if the audience comes ...
read more
On synchronization and "the cloud"

Wed 09 June 2010

I've been meaning to do a followup post on N900/Maemo5, but every time I summon the effort to start drafting the post, a new firmware comes out to address problems motivating the post. Case in point: the most recent firmware (PR1.2) finally added the USSD code support ...
read more
Time Management for System Administrators review

Fri 30 April 2010

After Coders At Work, I needed to decide what next to read in my professional sphere. I've been slowly collecting rainy day ideas and ToDos in a text file, and moved them into Evolution when that got long enough that I needed summary views to hide notes for each ...
read more
n900 arrival and notes.

Thu 10 December 2009

The phone arrived, and I'm recording a few notes on initial experiences, covering mail, the display, the browser, available apps, battery life.

Mail. "Mail for Exchange" worked fine, surprisingly. There are two popular versions of exchange, 2003 and 2007. Last I checked 2007 wasn't supported by Ubuntu (this ...
read more
Don't let the MSRP fool you

Fri 20 November 2009

I ordered up a Nokia N900 the other day, and I have to say the preorder market for it is strange. Or perhaps, I don't participate in preorders often enough to know that this is common.

The price listed in the Nokia Store and press releases is around 650USD ...
read more
An electronic diversion

Sun 26 July 2009

I've always felt a bit mystified with analog electronics. Sure, I had a few chances to figure it out, but these sorts of things require an experienced guide. When I was a child, I received a Christmas gift of an AM radio kit. It didn't work; my father ...
read more
Incentives

Fri 15 May 2009

I had drafted an article on UbuntuOne, but clearly this has been beaten to death. But has anyone else noticed how regressive Amazon S3 is? That's gotta have some unsavory market implications, and likely means an open source service available on S3 will be at a competitive disadvantage to ...
read more
About time

Tue 12 May 2009

FTC is gearing up to do something about Car Warranty robocalling scams.

Clearly these people are one step ahead technologically at the moment, to be able to wardial like that without being caught or even blocked. Maybe someone will write a phone app where you can just report these numbers ...
read more
Group Password Management Suggestions?

Wed 08 April 2009

In IT, it's common to segregate responsibilities not to individuals, but groups of people. This is handy for vacations, conferences, meetings or promotions -- power isn't endowed to a specific person and the redundancy means high throughput when necessary.

One problem is that not all systems we work with ...
read more