OpenID is pitched as an open and decentralized identity system, designed “not to crumble if one company turns evil or goes out of business”. This is great for the system, but still fails the user if their identity across the web is tied to that evil/bankrupt company. The system persists but the user is screwed.
The ‘big wins’ for OpenID thus far have been the decision by Yahoo, AOL and Google (well, Blogger) to become OpenID providers. It could now be assumed that most people online would have some kind of OpenID whether they knew it or not. This was a great step forward for encouraging relying parties and OpenID’s standing in general. However in the rush to embrace a URL-centric identity and tell people to make their Google/Yahoo/AOL URL their OpenID, we seem to be forgetting that it matters what kind of URL we use. It’s not enough that one URL is able to represent and authenticate who I am across the web, that URL should be in my control and portable, so that I am able to change my provider should I find out that they have been collaborating with oppressive regimes or their servers run on the blood of baby seals. We don’t need URL-centric identity, we need domain-centric identity.
With URL-centric identity we are locked to a particular provider, stuck with the unattractive choice of staying with that company no matter what it does (or does not do) or performing the laborious task of going into every site that we have ever associated with that OpenID and making the necessary changes. The system is set up to encourage stasis. With domain-centric identity, I control the URL that represents me. If my current OpenID provider provides poor security, fails to keep up with the pace of innovation or engages in practices I dislike I can change providers simply and easily. My identity is in my hands and the system is set up to encourage innovation and competition for my business.
Some might argue that people don’t care about who their OpenID provider is as long as it’s secure, but recent experience suggests this isn’t true. The SXSW OpenID panel saw a surprising number of questions fielded about the idea that OpenID seems to be moving towards an oligarchic version of Microsoft Passport in which two or three big companies controlled our identities. The less than comforting answer was that two companies is better than one. The potential acquisition of Yahoo makes that answer sound even more alarming.
Kaliya Hamlin recently wrote a post titled ‘What about Flickr?’ discussing the consequences of Microsoft owning Yahoo: ‘now with this hostile take over situation with MSFT it could be owned by THEM. It is really devastating to think that all the energy I and others put into this space would be owned by THEM.’ For Kaliya, the nature of the company that provides the service is as important as the service they provide. How would she feel if she used Yahoo as her OpenID and it was suddenly owned by THEM too?
If OpenID was designed so that no one company owns the identity management system for the web, making a domain your OpenID ensures that no one company owns your identity for the web. The easiest way to make your domain your OpenID at the moment is through delegation, and Simon Willison has written a handy guide on how to make that happen. For those without domains, chi.mp will be providing them for free later on in the year.
Delegation and domain-centric identity means greater competition and innovation between providers not just to attract new entrants to the market but to retain current customers. It means I have sole control over who I am across the web. If the OpenID community really wants to put people in control of their identity online, there should be less talk of signing up with behemoths and more talk of delegation, less talk about Yahoo OpenIDs and more talk about our OpenIDs.