Our WeblogOn Friday, December 12th, we successfully concluded our 2008 Annual Meeting. The key business consisted of revising our Corporate Bylaws and naming Jeff Smith and Kirk St. Amant as Directors Elect. They will take office on January 1st as Rob Akscyn rotates off of our Board of Directors to take a seat on our Advisory Board with our other former Directors.
Founded
22 November 2002
The Institute Online
The IEUC was established to engage in ongoing research and educational initiatives pursuing secure, simple, supple, and sophisticated systems to unlock our full human potential. It was established under New York State's not-for-profit corporation law and has been recognized by the IRS as a tax exempt public charity.
email: info@ieuc.org
Forging The Future 7/30/10 — 11:02 UTC
News and Views from The Institute for End User Computing!
Archive for December, 2008
The IEUC’s 2008 Annual Meeting
Tuesday, December 16th, 2008Self-Hosting OpenID Not Ready for End Users
Friday, December 5th, 2008OpenID is the name for a single login scheme that is supposed to free us of the need to juggle multiple user names and passwords. Instead, with OpenID, the theory goes, that we use a single login and sites we want to visit will redirect us to the OpenID provider of our choice for us to verify our identity with that service which will then return us to the site we were originally trying to log into with a security token that will complete the login process.
Since the system consolidates all of your accounts into one, it is critical that you trust your OpenID provider even more than you would a single site, since someone with database access to the OpenID server could usurp your identity everywhere by resetting your password to a new one and then logging into any of your accounts elsewhere.
The logical way to minimize that risk is to host your own identity provider server, which is supposed to be quite painless and easy to do.
Be warned, it is not.
For the last few weeks we have been trying various OpenID servers and have yet to find one that can pass all of the OpenID Enabled: OpenID Tests.
If you do want to experiment with this technology, we recommend indirectly specifying your OpenID End Point. This means that you should point any services requiring you to use OpenID to a web page that uses link tags in its headers to redirect them to your current OpenID provider of choice. Then you can, in theory, change OpenID providers without changing your OpenID Identity with respect to third party sites. However, different implementations may place restrictions on your account name choice which could foil your attempt to seamlessly swap servers.
If you can find a solution that reliably performs well in the real world, do let us know so we can share your good news. Until then, beware the hype and avoid diving in prematurely since this sort of experimentation can be a real time sink.
So in the meantime, if you must use OpenID, go with a large trusted “name” provider and if there isn’t one that you truly trust, consider establishing multiple OpenID’s for different accounts, even though doing this would of course defeat the point of the entire exercise.