1. The implications of
Simon Willison
XTech, 18th May 2007

2. This talk is
not about
identity

3. “identity”
implies lots of
unanswered
questions

4. I’m bored
of unanswered
questions

5. I’m going to
answer
as many questions
as possible

6. (To keep things easy,
I get to ask them)

7. Who here has used
OpenID?

8. Who uses it regularly?

10. What is OpenID?

11. OpenID is a
decentralised mechanism
for Single Sign On

12. What problems
does it solve?

13. “Too many passwords!”

14. “Someone else nabbed
my username”

15. “My online profile is
scattered across
dozens of sites”
(potentially, at least)

16. What is an OpenID?

17. An OpenID is a URL

18. http://swillison.livejournal.com/

19. http://simonw.myopenid.com/

20. http://simonwillison.net/

21. http://openid.aol.com/simonwillison/

22. What can you do
with an OpenID?

23. You can claim
that you own it

24. You can prove
that claim

25. Why is that useful?

26. You can use it for
authentication

27. “Who the heck are you?!”

28. “I’m simonwillison.net”

29. “prove it!”

30. (magic happens)

31. “OK, you’re in!”

32. So it’s a bit like
Microsoft Passport,
then?

33. Yes, but Microsoft
don’t get to own your
credentials

34. Who does get to
own them, then?

35. You, the user, decide.

36. You pick a provider

37. (just like e-mail)

38. So I’m still giving
someone the keys
to my kingdom?

39. Yes, but it can be
someone you trust

40. If you have the ability to
run your own server
software, you can do it
for yourself.

41. OK, how do I use it?

47. So my users don’t
have to sign up for an
account?

48. Not necessarily

49. An OpenID tells you
very little about a user

50. You don’t know
their name

51. You don’t know
their e-mail address

52. You don’t know
if they’re a person
or an evil robot

53. (or a dog)

54. Where do I get that
information from?

55. You ask them!

56. OpenID can even help
them answer

61. How can I tell if they’re
an evil spambot?

62. Same as usual: challenge
them with a CAPTCHA

63. botbouncer.com can tell
you if their OpenID has
passed a CAPTCHA before

64. (assuming you trust
botbouncer.com)

65. So how does OpenID
actually work?

68. <link rel=quot;openid.serverquot;
href=quot;http://www.myopenid.com/serverquot; />

69. “I’m simonwillison.myopenid.com”

70. Site fetches HTML,
discovers identity provider

71. Establishes shared secret
with identity provider
(Using Diffie-Hellman key exchange)

72. Redirects you to the
identity provider

73. If you’re logged in there,
you get redirected back

74. How does my identity
provider know who I am?

75. OpenID deliberately
doesn’t specify

76. username/password
is common

77. But providers can
use other methods if
they want to

78. Client SSL certificates

79. Out of band
authentication via SMS,
e-mail or Jabber

80. IP based login
restrictions

81. (one guy set that up
using DynDNS)

82. SecurID keyfobs

83. No authentication at all
(just say “Yes”)

84. Just say “yes”?

85. Yup. That’s the OpenID
version of bugmenot.com

86. http://www.jkg.in/openid/

87. Users can give away
their passwords today -
this is just the OpenID
equivalent

88. What if I decide I
hate my provider?

89. Use your own
domain name

90. Delegate to a
provider you trust

93. <link rel=quot;openid.serverquot;
href=quot;http://www.livejournal.com/openid/server.bmlquot;>
<link rel=quot;openid.delegatequot;
href=quot;http://swillison.livejournal.com/quot;>

94. Support for delegation
is compulsory

95. Minimise lock in

96. So everyone will end up
with one OpenID that
they use for everything?

97. Probably not

98. (I have half a dozen
OpenIDs already)

99. People like maintaining
multiple online personas

100. professional
social
secret
...

101. OpenID makes it easier
to manage multiple
online personas

102. Different OpenIDs can
express different things

103. My AOL OpenID proves
my AIM screen name

104. A last.fm OpenID
could incorporate
my taste in music

105. My LiveJournal OpenID
tells you where to find
my blog

106. ... and a FOAF file
listing my friends

107. doxory.com uses this
for contact imports

108. An OpenID from
sun.com proves that
someone is a current
Sun employee

109. Why is OpenID worth
implementing over all the
other identity standards?

110. It’s simple

111. Unix philosophy:
It solves one,
tiny problem

112. It’s a dumb network

113. Many of the competing
standards are now on
board

114. Isn’t putting all my
eggs in one basket
a really bad idea?

115. Bad news: chances are
you already do

116. “I forgot my password”
means your e-mail
account is already an
SSO mechanism

117. OpenID just makes this
a bit more obvious

118. What about phishing?

119. Phishing is a problem

120. I can has lolcats!? BETA
Make your own lolcats! lol
Sign in with your OpenID:
OpenID: Sign in

121. Fake edition
Your identity provider
Username and password, please!
Username:
Password:
Log in

122. Identity theft :(

123. An untrusted site
redirects you to your
trusted provider

124. Sound familiar?

125. That’s how Paypal works!

126. It still sucks though

127. One solution: don’t let
the user log in on the
identity provider
“landing page”

129. Better solutions

130. CardSpace

131. Seat belt

132. Native browser support
for OpenID

133. Competition between
providers

134. How do I implement
OpenID on my site?

135. As a consumer...

136. Grab an OpenID library
for your chosen
language or platform

137. www.openidenabled.com

138. Allow your existing
users to associate their
accounts with one or
more OpenIDs

139. (make sure you
authenticate the
OpenIDs first)

140. Allow people to kick-
start the registration
process with their
OpenID

141. Make passwords
optional during signup if
an OpenID has already
been confirmed

142. As a provider...

143. Figure out your anti-
phishing mechanism

144. Read the spec!

145. Why allow multiple
OpenIDs per account?

146. People can still sign
in if one of their
providers is down

147. People can un-associate
an OpenID without
locking themselves out

148. You can take advantage
of site-specific services
around OpenID

149. Any other neat tricks?

150. Yes, lots!

151. Lightweight accounts

152. Pre-approved accounts

153. Social whitelists

154. OpenID and hCard

155. Decentralised social
networks?

156. “People keep asking me to join
the LinkedIn network, but I’m
already part of a network, it’s
called the Internet.”
Gary McGraw, via Jon Udell, via Gavin Bell

157. What are the privacy
implications?

158. Cross correlation of
accounts

159. Don’t publish a user’s
OpenID without explicit
permission

160. The online equivalent of a
credit reporting agency?

161. This could be built today
by sites conspiring to
share e-mail addresses

162. IANAL, but legal
protections against this
already exist

163. OpenID 2.0 makes it
trivial to use a different
OpenID for every site

164. Patents?

165. Sun have pre-announced
a “patent covenant”

166. They won’t clobber
OpenID with their
patents

167. They’ll clobber anyone
else who tries to

168. Who else is involved?

169. AOL - provider, full
consumer by end of June

170. Microsoft: Bill Gates
expressed their interest

171. (Mainly as good PR for
CardSpace)

172. Sun: Patent Covenant,
33,000 employees

173. Six Apart

174. VeriSign

175. JanRain

176. You?

177. http://openid.net/
http://www.openidenabled.com/
http://simonwillison.net/tags/openid/

178. Thank you