As we have all seen plastered across the tech sites and numerous blogs (in between the daily Yahoo news), OpenID made a major announcement last week. For those of us that happened to be disconnected from the Internet… Google, IBM, Microsoft, VeriSign and Yahoo joined as OpenID’s first corporate board members.
So why is this important? Well, let’s just call this the little community project that could. In short, OpenID is a common standard that allows a user to have a single identity across many different “Web” applications (SSO for the masses). Yes, this has been attempted before, and failed. But, OpenID is a little different in that a provider doesn’t own your identity, rather you own it. In other words, there isn’t a single controlling entity which dictates the lifecycle of an identity. Instead, if you want to move providers, or even become your own provider you can (if you really wanted to).
What does this mean… Well… considering that this is an open framework, which isn’t controlled by an evil corporation, that’s based on a common standard, which reduces the burden of identity management (for both application providers and users), while solving global warming… (err… maybe not that last one). OpenID does provide a vehicle from which many of the hassles associated with online identity management can be tackled.
Does this have a drawback… Well, in the back of my head, I’m hearing this voice that keeps yelling things out like:
- Strong authentication
- Non-repudiation
- Identity conflicts
- Preventing phishing attacks
- Establishing trust
For some of these items, I know there are already solutions out there. For example, some OpenID providers have strong authentication services. However, my concern right now is that the standard has yet to reach a certain point in maturity to trust it for more than just common consumer sites. However, with the addition of the new board members, I’d expect these kinks will be worked out (unless I’ve completely overlooked something, and the thrashing will begin).
