1. Identity 2.0
OpenID & User Centric Identity
Martin Strandbygaard
Open Source Days, 4th October 2008

2. ?
How Many Have Used OpenID

3. ?
How Many Use It Regularly

4. Who Am I

5. “Martin Strandbygaard”

8. martin@strandbygaard.com
martin@strandbygaard.net
martin.strandbygaard@safewhere.net

9. All Part Of My Identity

10. Something I Say
Something I Claim

13. This Is Also Part Of My Identity

14. What Others Say About Me

15. (What Others Say = More Trusted)

16. Identity = Reputation

17. How Do I Prove It?

18. = “Martin Strandbygaard”

19. I control it.
I choose when to use it.
Issuer doesn’t know when I do so.

20. Asymmetric trust =
scalability

21. -

22. ... Proves Your A Database Entry

23. Doesn’t Say Anything About You

25. Identity 1.0
- Dick Hardt, OSCON 2005

26. OpenID Gives You A Digital Passport

27. http://martin.strandbygaard.net
http://strandbygaard.wordpress.com
http://claimid.com/strandbygaard

28. “Proves You Are You”

29. “Internet Users Either Distrust Or Snore
Over Microsoft Passport Live ID”
- Gartner, 2001

30. OpenID is a simple, open, and
decentralized authentication system

31. Live ID/Google/
OpenID
Adobe/....
Open ! !
Decentralized ! !
Simple ! !
Free ! !

32. What’s It Good For?

33. ! “Too Many Usernames and Passwords”

34. We all know this ...

36. ! “Too Many Usernames and Passwords”
! “Someone else took my username”

37. “martin” is already taken.
What about “martin325”?

38. ! “Too Many Usernames and Passwords”
! “Someone else took my username”
! “Not another registration form”

45. Text

53. ! “Too Many Usernames and Passwords”
! “Someone else took my username”
! “No more registration form”
! “Identity scattered all over the Internet”

54. !=

55. Who has one?

56. > 500 million
“... bringing the grand total of OpenID enabled users
on the Internet to well over 500 million users.”
Bill Washburn, July 2008
CEO, OpenID Foundation

57. Come again?

58. That’s 7,5% of everyone!

59. Probably far fewer in
Africa ....

60. And far more in Europe
and the US

61. Where’d They All Come From?
~250 million
~100 million
~65 million
~10 million

62. ?
What About Google
and Microsoft?

69. ?

70. ?

71. How Do I Get One?

72. Less Than A Minute
! Pick A Provider

73. OpenID Providers

74. Less Than A Minute
! Pick A Provider
! Sign Up

75. Less Than A Minute
! Pick A Provider
! Sign Up
! Use It

76. How Does It Work?

77. 1. Go to site
3. Redirect to
5. Redirect back to site 2. Associate
OpenID provider
4. Authenticate

81. ? Can I switch OpenID
provider and keep my
OpenID.

83. So what’s not so great?

84. 1. Go to site
3. Redirect to
5. Redirect back to site 2. Associate
OpenID provider
4. Authenticate
A Malicious Relying Party

85. Bad Site
Leads To ....

87. Untrusted site redirects you
to the trusted provider.

88. Who Else Does This?

89. ........

91. ! Brittle
OpenID is all eggs in one basket.

92. “I forgot my password”

93. ! Identity Provider Is Single
Point Of Failure

94. 1. Go to site
3. Redirect to
5. Redirect back to site 2. Associate
OpenID provider
4. Authenticate
Your Identity Provider Knows Where you take It.

95. Where Can I Take It?

96. It’s on the rise

97. “We expect more than 50.000 OpenID
enabled sites by then end of 2008.”
Bill Washburn, July 2008
CEO, OpenID Foundation

99. I Want To Know More
Dick Hardt @ OSCON 2005
http://identity20.com/media/OSCON2005/
The implications of
Simon Willison @ Google Tech Talk
Simon Willison
http://www.youtube.com/watch?v=DslTkwON1Bk
Google Tech Talk, 25th June 2007

100. Any Questions?