Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The Future of OpenID

The Future of OpenID

Slides from a presentation I gave way back in 2007 at the Future of Web Apps conference in London.

Simon Willison

February 21, 2007
Tweet

More Decks by Simon Willison

Other Decks in Technology

Transcript

  1. Last night on TechCrunch: It’s definitely time to declare OpenID

    a winner and the hope for making a single-sign on world a reality.
  2. • What problems does OpenID solve? • How does it

    work? • What Cool Stuff can you build with it? • What’s wrong with it?
  3. Yahoo! - Help Already have an ID or a Yahoo!

    Mail address? Sign In. Fields marked with an asterisk * are required. Create Your Yahoo! ID * First name: * Last name: * Preferred content: Yahoo! U.S. * Gender: [Select] * Yahoo! ID: @yahoo.com ID may consist of a-z, 0-9, underscores, and a single dot (.) * Password: Six characters or more; capitalization matters! * Re-type password: If You Forget Your Password... * Security question: [Select a Question] * Your answer: Four characters or more. Make sure your answer is memorable for you but hard for others to guess! * Birthday: [Select a Month] dd , yyyy * ZIP/Postal code: Alternate Email: Verify Your Registration * Enter the code shown: More info This helps Yahoo! prevent automated registrations. Registration Verification Code
  4. •Decentralised - you pick who you want to manage your

    identity •Your identity is a URL •e.g. swillison.livejournal.com
  5. •Single Sign-On by entering just your username •What about account

    creation? •Do we still have to fill out a form?
  6. •OpenID doesn’t dictate the authentication method used by OpenID providers

    •Jabber authentication •Secure browser certificates •RSA keyfobs •DynDNS to bind to your IP
  7. •TechCrunch links to dozens of new startups every week •TechCrunch

    readers aren’t going to create dozens of new accounts every week Startup fatigue
  8. •The Internet is a dumb network •It gets packets from

    A to B •It’s up to A and B (the applications) to do the smart stuff •The intelligence is on the edges
  9. •OpenID is a dumb network •It lets X tell Y

    that Z can prove ownership of a URL •It’s up to X and Y to do the smart stuff •The intelligence is on the edges
  10. Light-weight accounts •Any application that people normally wouldn’t bother to

    create an account for •Use OpenID to extend the lifetime of cookies
  11. Pre-approved accounts E-mail a friend and say: “I’ve added you

    to as an author to the blog I set up for our band”
  12. Corporate SSO •You can use OpenID behind the firewall •username.internal.example.com

    •Restrict your applications to only accepting OpenIDs of that format
  13. •hCard •Your OpenID can embed your public contact details •XFN

    •You can import a user’s contacts by introspecting their OpenID OpenID and Microformats
  14. •"Log in with your LiveJournal OpenID and we'll import your

    LJ contacts" •"Log in with your AOL OpenID and we'll send you updates over AIM" Site-specific OpenID hacks
  15. Social whitelists •Came from discussions around moderation with Tom Coates

    •Publish a list of the OpenIDs that you trust to comment on your blog without needing moderation •Syndicate the trusted whitelists from your friends
  16. •You can export a Jyte group as a simple whitelist-style

    list of OpenIDs •You could manage an invite only group using Jyte, then hook that in to another site’s authentication mechanism Jyte group export
  17. One for the applications •This is a similar problem to

    password recovery •E-mail the user a reset token •Allow users to associate multiple OpenIDs with their account
  18. If it takes 30 minutes to explain it to a

    room full of geeks, what chance has anyone else got?
  19. Your help needed! (Or if you like, this is an

    Exciting Business Opportunity)
  20. You are not signed in (Sign In or Register) Report

    a bug | Copyright GNR Labs 2007 What is Open ID? What is a .name Personal Address? How does it work? How long is the Free Trial? Welcome to YourID.name Welcome to the service that is likely to do as much for your identity online as your birth certificate has done "offline". We personalize your presence online and help you manage your identity on the Internet - who gets what information, what is it used for, and how you can be reached. We make it easier for the "good guys" to find you, and harder for the "bad guys" to get, use or abuse your information. We activate your personalized address for all your web identity data and services on the Internet personal identity space, .name, and an email address you actually can own for life, as opposed to having an address on someone else's domain. It comes with an identity management service using OpenID, and optionally, a personal webpage aggregator powered by Pageflakes. Try it today for free for 90 days! You'll love it - no strings attached. Your name is the basis for your openID, your fully personalized email address and web page. Your name: Firstname Lastname