Johannes talks about the OpenID RP "Problem"

Johannes Ernst has responded to my post on what I view as a problem for OpenID - the proliferation of OpenID Providers without the emergence of Relying Parties that use them. First of all, let me state for the record that I am a big fan of OpenID, and in no way view this problem as being one that will cause OpenID to "die out", as Johannes seems to think. I actually think OpenID will become part of the solution to our current internet problems of credential blowup, and look forward to that becoming reality. But, like Johannes, I want that day to arrive sooner rather than later. And anything that I see causing that to get pushed out a few more years concerns me. The intent of my post was to elicit just such a response from someone involved with OpenID like Johannes, and then dig a little deeper to figure out what needs to happen next.

Now, in his post, Johannes points out the reality of OpenID adoption - that it is a classic chicken-and-egg problem. As he points out, becoming an OpenID Provider is quite easy and relatively harmless (though reliability concerns do enter the picture), and mainly strategic in nature. On the other hand, becoming an OpenID RP has many more considerations and is far more operational, and therefore risky, in nature. By the very necessity of its invention, OpenID has to achieve critical mass in certain classes of IdP before it can be poked and tested to make sure that it is safe and reliable enough to support RPs. The adoption curve for any technology usually follows this kind of path, and so it is with OpenID. Today the RPs are mostly blog commenting systems and simpler, less sensitive services. Tomorrow, you could be using OpenID to authenticate to your online banking account. But there is a lot to be solved and proven along the path from point A to point B.

So if this path is exactly as it should be, what is there to be concerned about? Well, I guess I should have been more explicit in my last post. The thing that worries me is that the thinking seems to be that there is a lot more value in "owning the silo" -  in other words, being an IdP than an RP. So even if the OpenID industry does all the right things, will we ever get to the point where the number of OpenIDs a person has is a manageable number (the true intent of OpenID)? The way that the heavy hitters are rolling out their OpenID Providers leads me to wonder if the "exclusive" arrangements that are starting to pop up in RPs are going to become the norm, forcing users to maintain OpenIDs with a large number of Providers.

Obviously John Q. Public knows little, if anything, about OpenID. So expecting them to understand the message "Log in with your OpenID" on a website is irrational. The solution right now seems to have become websites displaying the message "Log in with your Yahoo ID" (which behind the scenes converts it into the requisite OpenID). This is a neat trick, but creates exclusive IdP-RP relationships that (in some sense) violate the spirit of OpenID. And given that these same heavy hitters now own many of the web properties that I would expect to be RPs (why is FlickR an IdP and not an RP?) makes me wonder if true OpenID adoption is getting pushed out by a few years, effectively postponing the work that needs to be done to make the OpenID system more robust in nature.

20070220_dogtag

Maybe I'm being too pessimistic about all this. But as of today, I have accounts in about 60 different places that I actively use, and only 3 of them are an OpenID RP. I want to move on to the next level, and am wondering what needs to happen to precipitate that.

Comments:

Nishant, I was very excited when OpenID was born, and quickly obtained an ID. For about a year, however, there was nothing I could log into with it. Finally, I joined Plaxo, and could use my OpenID in one place. Hardly a need for an OpenID standard, but I hoped that it would only be one of many. Then, Yahoo announced support for OpenID. As a Yahoo mail server, I thought that this was great news until I found out that Yahoo's idea of support was that I could use my Yahoo ID to log into other sites. Facebook recently came out with a similar announcement. Soon, apparently, I'll be able to use my Facebook login to login to other sites that accept it. Doesn't this all defeat the purpose? I want to use my existing OpenID to login to both Yahoo and Facebook. What part of that do they not understand? Kevin

Posted by Kevin Moulton on August 10, 2008 at 02:55 AM EDT #

Hi Nishant, Good article, I have two questions: 1. What are the strategic advantages of becoming an IdP? 2. As a consumer or RP, how do I know if an IdP is reliable? I hope you can answer these questions, or maybe talk about them in your next posting.

Posted by Mark Workel on August 22, 2008 at 12:53 AM EDT #

Mark, Interesting questions. I will think about it a bit and post my response in an upcoming post. But here's a preview: I think your second question kind of points out the answer to question number 1. Nishant

Posted by Nishant Kaushik on August 22, 2008 at 07:46 AM EDT #

Post a Comment:
  • HTML Syntax: NOT allowed
About

bocadmin_ww

Search

Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today