It should be noted to all of you coming from O’Reilly’s radar. That OpenID (the latest version) does accept i-names and identityprovider URL’s (this is the Sxip way of identity provision).
One of the reasons that i-names are cool is that they have persistence in a way that URLs have some challenges with in the long run. The names can be transfered to a new person but the i-number underneath is not. If you have domain name you are using as your identifier and you don’t renew it. The new owner of the URL can use it to sign-in to places you have had accounts.
i-names also have a nicer syntax and hopefully work for the internet users who may never get they can use URL’s to login.
Open Source
I did it! SSO is really here and some cool identity links
I of all people should have done this before but I was waiting for OpenID 2.0 to be out there and working so I could use my i-name. I went to Ma.gnolia today and it just worked. They have a great way to integrate an OpenID with an existing account. I hope that I can pull over my delicious bookmarks. I joined the Identity 2.0 bookmark group.
I found some interesting sites
Wikidentity is a Flash client that shows you any hCards in a page you are browsing, and allows you to search for hCards that other users have helped index. You can also export hCards that you’ve discovered to use in a variety of applications, such as Address Book.
hCards are nice but I am not about to post mine on the web for anyone to scrape.
Unit Structures latest recommendation to Social Network Designers:
In the past, I’ve done a good deal of writing explaining how to design better and more relevant SNS. Today I offer designers of social network sites my single most valuable piece of advice: Adopt OpenID.
The walled gardens will stay with us, but walled gardens in social network sites need to be a thing of the past. Imagine the pitch – you can add friends from any OpenID network to your SNS. This has huge, democratic possibilities. This feels natural for SNS – walled gardens don’t. If you’d like to find out more about OpenID, you can refer to this primer I wrote about it on the ClaimID blog, or you can email me and I can help put you in touch with folks who will be able to help you. Once you grasp OpenID, and see how naturally it works with SNS, you’ll see what a valuable direction it is to take your product.
OpenID is coming – the tipping point grows closer each day. This is a tremendous opportunity – and I do hope you’ll consider it seriously. This is the way of the future.
The thing I don’t like so far is that it doesn’t make recommendations the way Delicious does. Maybe this is a forthcoming feature.
I found this article by David Kerns on reputation and trust that points to Clippinger’s blog. He has not posted since 2005. According to the social physics site he has a book coming out next year. Interesting. I wonder if Doc can convince him that blogging ideas and parts of the book and sharing with them the community might be a good idea. It seems that if markets are conversations books certainly are. As Kim learned with the Laws of Identity getting community input was a good idea for everyone.
The importance of Annonymity being baked into our systems is highlighted by Ben Laurie:
Firstly, when I say anonymity should be the substrate I am not just talking about the behaviour of identity management systems, I also mean that the network itself must support anonymity. For example, currently, wherever you go you reveal your IP address. Any information you give away can be correlated via that address. People sometimes argue that this isn’t true where you have a dynamic address, but in practice that isn’t the case: most dynamic addresses change rarely, if ever – certainly they tend not to change unless you go offline, and the rise of always-on broadband makes this increasingly unusual. Even if the address does change occasionally, you only need to reveal enough information in the two sessions to link them together and then you are back to being correlated again.
Secondly, people seem to think that privacy is an adeqaute substitute for anonymity. I don’t believe this: privacy is all about voluntarily not linking stuff you could link. Anonymity is about making such linking impossible. Microsoft’s Cardspace claims to provide anonymity where, in fact, it is providing privacy. Stefan Brands comes close with his selective disclosure certificates, but they are still linkable, sadly. These systems only provide privacy if people agree to not make the links they could make. Anonymity provides privacy regardless of people’s attempts to undermine it. That’s why you need to have anonymity as your bottom layer, on which you build whatever level of privacy you can sustain; remember that until physical onion routing becomes commonplace you give the game away as soon as you order physical goods online, and there are many other ways to make yourself linkable.
I do sense that this is not being thought about enough. I hope that Stefan can participate more actively in the community so that we will address it more fully.
I found this post by Bokardo a social web designer. He has a post on Domain as Identity and the services behind it. I totally agree and I can’t wait for him and others to discover the cool things they can do with XRI and XRDS. The TOTH (Thrill of the Hack) experimentation has just begun 🙂
I would encourage you guys to join Ma.gnonlia – for two reasons one it is OpenID2 enabled AND it has cool group bookmark sharing features.
Scott Says: Data is the New Software
I like the sound of that could it be Data 2.0?
Scott Keveton has a great post on why the big guys should adopt OpenID and hopefully Open Standards for Data too. He has three more reasons besides these two great ones:
Data is the new software: People may laugh at me on this, but its not the software. Software is effectively free now. Content management systems, wikis, blogs and even operating systems are commodities now. Its what you do with the software that is interesting. Its the sets of data that you can create and correlate together that are really, really interesting. Just look at Google. They arguably use more open source (aka free software) than anybody around. Its how they hook that software together and correlate the data from their users that’s the interesting stuff. Now, when you have lots of data, identifying who did what becomes the key. We haven’t had a thin layer of identity to do this in the past. OpenID gives us that layer of identity and more importantly a way for users and sites to correlate and better represent data that the users are creating.
Data + Identity == GoodStuff: As per my last item, data coupled to identity is really interesting. What’s even more interesting than that are the things you can do with identity and data coupled together. Now that I am this one identity for all of the places that I’m going on the Internet, I can really start to provide some services for that OpenID that I couldn’t before. Attributes, reputation, trust and social networking are some of the interesting areas to look at when it comes to OpenID in 2007
UX and OpenID the hickups are beginning
The weather that Tom brings us on OpenID is mixed but good in the long run. He says that community is what counts 🙂
Here’s what I learned enabling the sites with OpenID:The Good: OpenID registration is a beautiful thing. The legacy registration page on Stuffopolis can be scrapped. Once that happens, validating email addresses, requiring passwords and lost password security questions for new members will be forever outsourced to the OpenID providers (those that your website trusts).
The Bad: When introducing OpenID, it is a breeze for new members coming to the site, but it can be a little confusing for existing members who registered with the legacy credentials. When those existing members find out about the OpenID option, instead of logging in with the legacy credentials to add the OpenID to their account, they often log in with their new OpenID instead. This log-in will attempt to create a new account by fetching simple registration data from their identity provider. If their email address (sent by their identity provider) matches the one already registered with their legacy account, they can be given some instructions, but sometimes it doesn’t match and now we have a problem because if they go back and log in with the legacy credentials, they can’t associate their new OpenID to it because another account (the one they accidentally created) now has that OpenID.
Update 12/17: What I need to do is when a member goes to his profile page and attempts to modify his OpenID, after a successful OpenID authentication, if the site detects that there is another account with the same OpenID, then the site will ask the member to confirm that he wants the other account deleted, making sure there is only one account with that OpenID.
The Ugly: Now that some popular open source packages (wordpress, mediawiki, phpBB) support OpenID, the software should honor each other’s OpenID sessions so that someone who logs into mediawiki with his OpenID doesn’t get presented with an OpenID login form when he visits phpBB, for instance. Although this isn’t a huge problem, it is a little ugly and it seems it will require a standard way of registering OpenID apps on a system so that an OpenID session state change in one app will inform the others.
In a nutshell: OpenID is still immature, but it has an extraordinarily committed community behind it and when it comes to software, that’s what counts.
What is a Barrier to Entry – OpenID
This comment was posted by Vivek Puri at the bottom of Ramana’s post (quoted above).
OpenID is great idea, but adds another layer of complexity for early adopters. This might not go down well with the startups who can end up loosing important initial users. Also bigger companies like Google will offer Single Sign-on only for their own apps which becomes another point of disconnect. In my case I use Writely for document editing, Editgrid for spreadsheet, and del.icio.us for bookmarks which is a pain to manage.
As for offline usage, that is a very much required feature. Especially Writely should be able to implement that part easily since they have already cracked the algorithm for multi-user data edit and sync. Groove networks does offer that feature but is not for individual.
I guess there is some miscommunication in what OpenID is and how it actually lowers the barrier to entry to try new Office 2.0 applications.
This is how I see it.
I have my blog URL that is openID enabled or I have an i-name. I now can go to any one of the new groovy Office 2.0 applications and instead of getting yet another login and password. I just use my OpenID. I don’t have to put it into that spreadsheet of all my names and passwords or just use the same one I use everywhere that is totally insecure. Instead I bring my identity to the site. I save time. If I am an early adopter type I will likely get an OpenID relatively quickly and it will be a handy fast way for me to try these things out. Of course Office 2.0 applications should not force people to have OpenID’s those who want yet another user name and password can have one.
I know personally I avoide signing up for anything new that requires yet another login. I would be more inclined to tryout an Office 2.0 application that has OpenID as a login option.
I think all these office 2.0 copmanies can collectively compete with the big silo’s by offering SSO amongst themselves.
