Our Weblog
OpenID is the name for a single login scheme that is supposed to free us of the need to juggle multiple user names and passwords. Instead, with OpenID, the theory goes, that we use a single login and sites we want to visit will redirect us to the OpenID provider of our choice for us to verify our identity with that service which will then return us to the site we were originally trying to log into with a security token that will complete the login process.
Since the system consolidates all of your accounts into one, it is critical that you trust your OpenID provider even more than you would a single site, since someone with database access to the OpenID server could usurp your identity everywhere by resetting your password to a new one and then logging into any of your accounts elsewhere.
The logical way to minimize that risk is to host your own identity provider server, which is supposed to be quite painless and easy to do.
Be warned, it is not.
For the last few weeks we have been trying various OpenID servers and have yet to find one that can pass all of the OpenID Enabled: OpenID Tests.
If you do want to experiment with this technology, we recommend indirectly specifying your OpenID End Point. This means that you should point any services requiring you to use OpenID to a web page that uses link tags in its headers to redirect them to your current OpenID provider of choice. Then you can, in theory, change OpenID providers without changing your OpenID Identity with respect to third party sites. However, different implementations may place restrictions on your account name choice which could foil your attempt to seamlessly swap servers.
If you can find a solution that reliably performs well in the real world, do let us know so we can share your good news. Until then, beware the hype and avoid diving in prematurely since this sort of experimentation can be a real time sink.
So in the meantime, if you must use OpenID, go with a large trusted “name” provider and if there isn’t one that you truly trust, consider establishing multiple OpenID’s for different accounts, even though doing this would of course defeat the point of the entire exercise.