Scott Kveton

Striking a balance: adoption meets security

The ability to link users data and more importantly their contributions on the Internet is becoming increasingly important. To me, identity is the key to unlocking the real potential of Web 2.0. Software is officially a commodity. Its what you can do with the software and the data that you can build/aggregate that will really define Web 2.0. Identity is at the root of this. If I have one identity that I can use everywhere and keep track of my contributions and data across the Internet then some really amazing things happen. More on that in another post.

How do we get a ubiquitous solution for identity out there? Do we focus on all of the edge cases first or do we just get something out that works for a good chunk of the users first? I’m a fan of the iterative “get-it-out-now-and-continue-to-evolve-it” school of thought. We’ve seen the other way of doing this stuff and those technologies haven’t seen wide-adoption among consumers. It’s got to work for users, be easy (and compelling) for sites to adopt as well as be secure. We’ve got the first two knocked out of the park with OpenID and things are getting easier and easier every day from a user/site perspective. We’ve even spun up a new user experience list.

Let’s remember that when the web originally was rolled out it was just a novelty. “Nobody will ever do banking on this thing.” But they did. SSL was created to solve the original limitations in HTTP and now billions of dollars/euros of commerce happen every day on the Internet.

There have been some heated discussions on the OpenID general mailing list regarding the lack of security in OpenID.

The one thing you should take away from this post is that security is a crucial concern of everyone in the OpenID community (including myself) and its something that is being addressed. We’re not there yet, but I do believe these things take time. Let me explain.

When OpenID was first developed, it was meant to be a very simple method of doing authentication. “I am this URL” was what it really was saying. This was perfect for the blogging community where it got its start. When commenting in the blogosphere, I’d like to be able to do it quickly and easily and ideally hook it back to my blog. OpenID was perfect for that.

OpenID v1.0 and even v1.1 were very rudimentary and solved maybe 80% of the use cases for what user-centric identity was aiming to do. In doing that it only took a 10 page specification. As you increase the use cases you want to handle, it gets more difficult to design and more importantly to implement and adopt. If we tried to cover all 100% of use cases from day one a) we would have gotten it wrong and wasted a bunch of time and b) it would be have impossible for anyone to implement quickly and easily.

The key factor we have to consider here is, does OpenID and its community have what it takes to become the ubiquitous solution for doing user-centric identity in a secure fashion on the Internet? I believe it does. An ever-growing eco-system of users, sites, vendors and communities are seeing its advantages based on its own merits. Lots of good discussions are happening on making this more secure and those changes are going into the specification.

OpenID is about striking a balance. User-centric identity is inevitable and its one of those problems that’s just perfect for solving in the “open source way”. The rate of adoption is quickly increasing and our ability to secure users’ identities with it is also getting better. If we hadn’t started out with something then there wouldn’t be anything to argue about.

We’re almost there. OpenID is at a tipping point. The users, sites and communities are coming and more importantly, are desperate for a solution to this problem. The best is yet to come.

About The Author

kveton

27th

October 2006

bykveton
posted in Identity, JanRain, OpenID
6 Comments »

6 Comments Add Yours ↓

The upper is the most recent comment

Greg K Nicholson #

10.28.2006 02:23
1
I just got an OpenID. Some thoughts:

OpenID.net and I Want My OpenID! seem to be very much advertisements for OpenID, intended to persuade randomers that they want one. Which is fine, but when the randomer in question decides they do want an OpenID, these sites don’t make it stupidly easy to get one.

It is fairly easy for someone with a little determination, but not stupidly easy for everyone. You can’t just say “Go to getfirefox.com and click Download”.

For example, the randomer has to figure out what an identity provider is, and then choose one based on nothing more than how sexy each one’s website is. This seems analogous to how the multitude of Linux distributions confuses newbies rather than providing choice – the newbie isn’t in a position to make an educated choice, so they guess, which makes them unsure of their decision. And the easiest choice is “none whatsoever”.

I found documentation such as https://www.myopenid.com/help#own_domain very useful; it ought to be replicated all over the place so that it can’t possibly be missed.

Also, hooking Gravatar up to OpenID would cause my s0×0rz to become thoroughly r0×0rz’d.
Ja #

11.01.2006 16:17
2
Perhaps I’m very out of the loop, but I followed OpenID for a long while and it was always very specifically stated that it was only meant to be a very simple lightweight identity protocol to do basically what you said: this url vouches for this user.

It’s always been a simple building block for trust networking and further security layers to be built upon.

The way I see it, the current problem is that it’s become a new web fad and it’s not being used properly. There’s really nothing in place for anything more than the very basic stuff that was there to begin with at this point. Honestly, I don’t see that changing for a while, especially with corporations in control of the web. Their ideas of decentralization are more like disjointment and they’re all very protective of letting go of their tracking/marketing abilities as well as eyes for their ad-serving abilities since the current revenue model depends on advertisements and monopoly money.

People are still thinking far too much about what will integrate with what’s currently hot. Most end users don’t even know what RSS is let alone anything to do with blogging, web 2.0 (spit), nor any of the jargon you rattled off in your post.

I’ve had lengthy discussions about decentralized networking/trust systems with very intelligent people of the computer generation and yet they still can’t grasp how it would be any different than what they currently use their Myspace account for. It’s truly maddening.

That’s where the problem is though. We don’t need people to be aware of the issues (which is an impossible task) but rather get together and build something that works transparently for these people and ourselves in a manner that’s convenient for each individual.

Ja

ps. for the record, I’m more concerned with making 1-degree of seperation networking and anti/non-social media networking a reality. Basically: decentralized networking using existing technologies to make it simple to do stuff that should be simple like keep up with friends, family, colleagues, etc while having fine-grained control over actual security permissions (exactly who can see or recieves what) and have information access really be user-centric rather than marketing-centric like it is now.
kveton #

11.01.2006 16:29
3
Thanks for the comment Ja.

I agree that the big players tie quite a bit of their valuation to the concept of “owning” the users. I’m really interested in empowering the sites out in the long tail; all of those sites that are doing things like photo and video sharing, blogging, social bookmarks, etc. For every single one of these sites, getting the user past the registration screen is one of the most difficult things for them. Its also a pain point for the users; yet another username and password to keep track of.

The benefit I seen in OpenID is that it solves a pain points for users and sites. The secondary benefit is what it will enable for users of all of those sites. The ability to quickly and easily communicate with friends and family, especially as social networks grow. OpenID is a tool that will hopefully be used to give context to users across a wide range different topics.

Is this going to happen overnight? Of course not. But nothing ever worth doing was easy.
Ja #

11.02.2006 05:12
4
Your comittment is appreciated and it does indeed make things less painful. What I’d really like to see in the shorter term is an adoption of Open-ID for things like forums as well as the newer things that I personally see as fads. Don’t get me wrong, I think blogs and smart social interest sharing/networking definitely have their place but the way we use things now have a lot of evolving to do and as you said, none of this stuff will happen over night.

With forums, which I’ve been using forever it seems, it’s such a pain to sign up for one every time I just want a post a single message. Most forums I visit I only use once or twice and never again. It’s a matter of going and getting/giving information on specific topics in a variety of specific places… most people only have one or two they actually frequent if any. Reputable forums are usually well moderated and don’t stand for abuse from any users, so I think it could be an interesting experiment to actually have an open-id provider be a reputable forum where I have an active account. Thoughts on that idea? Even without that, I’d definitely like to be able to avoid the situation I’m frequently faced with: spending more time signing up for forums than I do actually using them or in many cases not lending information I could because I don’t want to go through the hassle of having to register for something I likely won’t be coming back to. That’s where I think Open-ID could really be key in making traversing these little communities much less painful if the software devs and administrators were willing to implement it.

Do you know of any forum software with plugins or being built with Open-ID included? You may want to approach Matt with the idea of integrating it into BBPress if you haven’t already.

Speaking of which (since I saw him link to it), I’d love to hear any comments you may have on Parakey from whatever implications you feel can be gleaned from the article.

Cheers!

Jā
kveton #

11.02.2006 15:47
5
Users are getting a lot more sophisticated than we usually give them credit for. They may not know the techno mumbo jumbo that I often spout but they are “blogging”, sharing photos and interacting in rich social transactions like never before. All of those users that were supposed to show up during the bubble and never did are finally here. And they are doing things we never thought they’d do. This is the really exciting stuff IMHO.

Forums are a great place to look for more adoption of OpenID. I had some conversations with folks at phpBB but need to strike those up again. Can you think of any more apps that might be good to get in touch with to ask about support? BBPress and phpBB are a great start … I’d love a list of the other projects to look at and just start hittin’ them up to see if they would consider supporting OpenID.

I have not seen Parakey but thanks for the link to the article; I always like to hear what Blake is up to … :-) How could OpenID help with that? I’m not sure yet but it seems like being able to identify yourself inside of Parakey would be a critical element. Identity is a core requirement of just about any application out there today but its a mega-pain to have to keep re-inventing the wheel in every application.
Ja #

11.09.2006 11:18
6
I won’t make an issue of it, but I find all of the stuff people are doing these days on the web to be more scary than exciting. I know exactly the type of individuals you speak of and you’re right… they don’t know what a ping or a trackback is, but it doesn’t keep them from blogging, etc. The problems come into play when people that don’t really know a lot about what they’re doing really have no clue about the possible ramifications of what they’re doing or not doing.

I’d definitely be happy to help with getting a list together of potential projects to approach about openid integration. I could rattle a bunch off right now, but I know you have mailing lists and a wiki if I’m not mistaken, so those would likely be better venues.

Speaking of which, I am quite out of the loop as I mentioned earlier, but I do have more questions and always ideas so I’ll be trying to do some reading and catching up as time allows.

Oh, I think I just mentioned Parakey because it seems to be in line with some goals and almost at odds with others concerning identity/security. I don’t think OpenID will play a role in it at all. It’s too early to know anything about it though… just seeing if you had any early thoughts. :)

I read about the affiliate program and it looks like a wonderful way to really kickstart this stuff… I’ll be sending some people in your direction to take a look at that specifically!

Hopefully I’ll be making some stops on the lists and wiki, though time is going to be extremely tight until some time in January. Have you started on that list anywhere yet so I might tack stuff on it a bit at a time?

Regards,

Jā

Striking a balance: adoption meets security

About The Author

kveton

27th

October 2006

6 Comments Add Yours ↓

Your Comment

About Scott Kveton

Recent Tweets

Archives

Tags Cloud

Latest Post