SXSW Critical look at Open ID session - live random blogging

Sidenote: check out the Windows Live ID federation whitepaper which may address a lot of the issues below

OpenID attempts to solve the username/pwd problem

• the web needs SSO
• OpenID is a decentralized mechanism
• one organization owning the credentials has revolved
• any company can setup as an openid provider
• OpenID us a URL (an identifier)
• e.g. www.anguslogan.com
• OpenID proves that you own a URL
• OpenID does profile property transfer i.e. thirdparty.com asks for
• enhancement in OpenID 2.0 instead of typing "alogan.live.com" (i.e. the URI) you can just type "live.com" (or click a button) and it takes me to the provider.
• Q: how do you educate an end user? A: look at what yahoo has done
  • Analogy: email a few years ago was extremely hard; the barrier to entry is coming down.
• there is talk about mapping an email address to a URI
• end users dont know what a URI is but they know their myspace page;
• there is no central record kepeing;
• if u get redirected to the other site - can you trust the site isn't phishing
  • frame busting
  • SSL
  • best practices
  • this isn't a new problem
• some providers do SMS and out of band
• estonia has a national security card used for all interaction with the govt
  • there is an open id provider which allows any site in Estonia to auth using the national security card
• yahoo are a open ID PROVIDER but NOT A RELYING PARTY
• there was a huge debate on "why does everyone want to be a provider and
• there is a misconception that Windows Live ID costs a lot of money
• quote: you should pay a lawyer a lot of money if you trust any external source for COPPA compliance
• the simple reg/attribute exchange is recommended to only be used for pre-filling forms
• one of the questions is: the bits look superb - why aren't more sites using openid?
• the first time you implement it can be a couple of days "it can be a little fiddly"
• goog guy on usability: we can help normal users get over the hump, introduce them proactively to account association
• there is an ISV launching tomorrow which takes OpenID and makes it as easy as possible for END USERS
• www.clickpass.com
• if i sign up to plaxo using my OpenID - when I download the client bits I can't use it unless I create a Plaxo username/password...
• solution is to use OAuth and OpenID combined.
• twitter said they would support openid
• will openid help with comment spam
• distributed whitelisting
• reputation providers