‘openid’ Category Archive

April 16th

JanRain embraces domain-centric identity

by Tony Haile  |   3 Comments

I learned from Carsten Potter that myOpenID has just launched myOpenID for Domains. The new service makes it even easier for you to make your domain your OpenID. As I’ve said before, using domains as OpenID URLs is essential for personal ownership of identity online. Congrats guys, a great move.

April 8th

We don’t need URL-centric identity

by Tony Haile  |   10 Comments

OpenID is pitched as an open and decentralized identity system, designed “not to crumble if one company turns evil or goes out of business”. This is great for the system, but still fails the user if their identity across the web is tied  to that evil/bankrupt company. The system persists but the user is screwed.

The ‘big wins’ for OpenID thus far have been the decision by Yahoo, AOL and Google (well, Blogger) to become OpenID providers. It could now be assumed that most people online would have some kind of OpenID whether they knew it or not. This was a great step forward for encouraging relying parties and OpenID’s standing in general. However in the rush to embrace a URL-centric identity and tell people to make their Google/Yahoo/AOL URL their OpenID, we seem to be forgetting that it matters what kind of URL we use. It’s not enough that one URL is able to represent and authenticate who I am across the web, that URL should be in my control and portable, so that I am able to change my provider should I find out that they have been collaborating with oppressive regimes or their servers run on the blood of baby seals. We don’t need URL-centric identity, we need domain-centric identity.

With URL-centric identity we are locked to a particular provider, stuck with the unattractive choice of staying with that company no matter what it does (or does not do) or performing the laborious task of going into every site that we have ever associated with that OpenID and making the necessary changes. The system is set up to encourage stasis. With domain-centric identity, I control the URL that represents me. If my current OpenID provider provides poor security, fails to keep up with the pace of innovation or engages in practices I dislike I can change providers simply and easily. My identity is in my hands and the system is set up to encourage innovation and competition for my business.

Some might argue that people don’t care about who their OpenID provider is as long as it’s secure, but recent experience suggests this isn’t true. The SXSW OpenID panel saw a surprising number of questions fielded about the idea that OpenID seems to be moving towards an oligarchic version of Microsoft Passport in which two or three big companies controlled our identities. The less than comforting answer was that two companies is better than one. The potential acquisition of Yahoo makes that answer sound even more alarming.

Kaliya Hamlin recently wrote a post titled ‘What about Flickr?’ discussing the consequences of Microsoft owning Yahoo: ‘now with this hostile take over situation with MSFT it could be owned by THEM. It is really devastating to think that all the energy I and others put into this space would be owned by THEM.’  For Kaliya, the nature of the company that provides the service is as important as the service they provide. How would she feel if she used Yahoo as her OpenID and it was suddenly owned by THEM too?

If OpenID was designed so that no one company owns the identity management system for the web, making a domain your OpenID ensures that no one company owns your identity for the web. The easiest way to make your domain your OpenID at the moment is through delegation, and Simon Willison has written a handy guide on how to make that happen. For those without domains, chi.mp will be providing them for free later on in the year.

Delegation and domain-centric identity means greater competition and innovation between providers not just to attract new entrants to the market but to retain current customers. It means I have sole control over who I am across the web. If the OpenID community really wants to put people in control of their identity online, there should be less talk of signing up with behemoths and more talk of delegation, less talk about Yahoo OpenIDs and more talk about our OpenIDs.

March 28th

A Journey of a Thousand Steps

by Brian Oberkirch  |   30 Comments

In the last year, I’ve tried to think about, write about, argue for and cajole people into building portable social networks.  I think it’s the richest direction for the systems we design, for service providers and for people who use these services.  I choose my words carefully, thinking that short-term worries are standing in the way of long-term value & creativity.  There are a handful of technical building blocks at the ready, but as Kara Swisher notes, the problems around making social networks portable aren’t really technical.

I will happily note Microsoft’s recent work around their contact API, creating  limited interop with some of the leading social networks.  I would also point to the creation of the Open Social Foundation.  I interpret these as further signs of the inevitability of free(er) flowing social data.  While some of my peers are overly concerned about getting today’s social gorillas to adopt our approaches, I’m more interested in researching, testing & promoting the building blocks of what will become the more durable infrastructure of the social Web.  Which is to say, I don’t think it’s necessarily going to be built or mandated by today’s leading lights.

2368894694_d8964c1abb.jpg

If you want to see the future of social network interop, watch smaller, more nimble and daring players like Matt Biddulph, of Dopplr.  Above is a screenshot of his recent test, moving beyond contact import to contact subscriptions.  Or watch what happens as Ma.gnolia mandates OpenID for all new accounts. Dopplr and Ma.gnolia aren’t on the hook to generate revenues to support an untenable valuation.  We’ll see truer results from such experiments.  We’ll note what works.  What doesn’t.  Who benefits.  How we have to tweak that solution for other contexts.  We’ll rinse.  Repeat.

In this muddled, two steps forward, one stagger back dance, an interoperable social ecosystem will come to life on the Web.   No shot heard round the world that they can write up on AllThingsD.  The open social Web, like life, will happen while your back is turned.

It is for this reason that I think globalized, generic, manifesto-driven approaches are unsound.  No one wants data portability.  They want to reuse their Last.fm contacts to find the right muxtapes.  They want to invite all their PHP tagged contacts in Highrise to a particular event on Upcoming.org.  They want to share ffffound objects with select groups.  And so on.  Instead of acting like graduate students, let’s be makers.

My hope is that OwnYourIdentity.com will become an open notebook for those efforts.  And I invite you to help us write this story.