OpenID
June 1st, 2007OpenID is an open decentralized framework for identity management. In other words, it’s a scheme for a single sign on username and password that any website can use.
It’s an interesting idea. I like the idea of it, the thought of having a single definitive presence online. However, I can think of many more reservations:
Security is an obvious one. The most secure safe system in the world is still potentially useless if the human being at one end is willing to share their credentials (e.g. their password) willy nilly. I’ve seen too many office workers who stick their system password to their monitor on a post-it note, let alone the hoards who seem content to swap their passwords for chocolate. And even IT Professionals aren’t immune from being tricked into giving their passwords. In fact, according to some beer-mat statistics, they might even be worse. If one password is all you need to access many resources, the potential damage when/if that password is compromised is that much higher.
Privacy is another issue. If log-ins are unique on a per-site basis, it’s harder for a profiler to collect information from multiple sources and tie them to an individual. If you know that individual has the same identity on multiple sites, collecting that information becomes trivial. Privacy is a funny one, though, because that ability to link data across different contexts is potentially a powerfully useful one in terms of user enablement.
There are pragmatic issues to consider as well: in order for such a system to be a success, it has to be popular and widely implemented. This requires some big companies to overlook significant corporate advantages in having their own authentication data. It might be somewhat naive to hope this will happen without some considerable advantages to reward them for doing so.
I’m sure commenters can think of several others; despite that all, though, I’m still cautiously liking the idea: I can’t help it, I’m a romantic fool cursed with cynicism.
