Think Twice About Supporting OpenID
You probably remember that we’re big fans of OpenID. The concept, a single sign-on that is owned by no one, is too good to not support.
Developer Dare Obasanjo sees the promise of OpenID, but he also cautions not to blindly support OpenID on your site. He shares his OpenID lessons learned:
- The Problems OpenID Solves for Web Developers
- The Ideal OpenID User Experience
- The Risks of Using OpenID
- White Lists are Key
Some of these may not be new to you. One of the major complaints with OpenID is that the experience is sub-par and confusing to non-techies. While most people don’t notice the change from one URL to another, they do notice the sometimes jarring difference in site design. Similarly, with many users prone to phishing, one layer of security might not be the best solution.
The system is set up so that users choose providers they trust. But what about developers trusting the provider? Obasanjo brings up good points about improper validation and identity recycling (Hotmail, for example, deletes accounts after a few months of inactivity).
White lists are probably not the solution to the problem. That could take the “open” out of OpenID. If I have my own domain as my OpenID, do I have to contact thousands of sites to get my domain white listed?
There are many issues ahead of OpenID, but it’s an important part of the web’s future. To me it’s not a question of whether to support OpenID, but how. Luckily, there are people like Dare Obasanjo thinking critically about it. What do you think it will take to make OpenID work well?
See also:
