• On TV.com: THE GIRLS NEXT DOOR photos
April 21, 2008 12:01 AM PDT

OpenID getting more usable, a tiny bit at a time

Posted by Rafe Needleman
  • Print

Webware has been covering the Web authentication standard OpenID since September 2006. It's a powerful alternative to traditional name-and-password Web access control, but it's so completely different from the sign-on methods that people are accustomed to that it remains still unknown to the majority of Web users.

This is changing. Major companies such as AOL, Microsoft, Yahoo, and Google are on the OpenID standards committee. AOL and Yahoo, in fact, already act as OpenID "authentication providers;" if you have a login on either of these networks, you have an OpenID.

But the concepts of OpenID are still a bit too weird for ordinary mortals to use. It's in the interest of OpenID technology providers to fix that.

JanRain's OpenID Selector makes it much easier for users to understand OpenID logins.

On Monday, one of those companies, JanRain, will announce OpenID Selector, a widget that Web site owners can use to make logging in via OpenID easier.

It's a simple thing: It shows a list of OpenID providers and lets users click on the one they know they have an ID with. Then the user logs into their provider, and the site using the widget authenticates against it.

Users who don't have an OpenID can set one up from the widget. The default provider is JanRain's MyOpenID, which I use and find pretty straightforward.

Major sites, such as portals, could still do a much better job pushing the OpenID concept. That would be good for them, not just because it'd make OpenID more accessible to users, but because there's a lot of brand affinity that sites can win by having users authenticate against their sites even when they're using some other company's service. Think of OpenID branding as the affinity credit card of the Web: Every time a user logs on to a service they'd get the authenticator's brand popped up in front of them--just like Harley-Davidson does when its Visa affinity card users make purchases.

JanRain, not surprisingly, gets this, and will provide a complete white-label OpenID technology infrastructure for companies or brands that want to become authenticators. So if you want to log on to Web sites with an ID from your alma mater or local Rotary club, JanRain will make that possible.

It remains to be seen when, or if, banks will get this idea, and start leveraging their your-money-is-safe-with-us message into digital safekeeping as well.

Rafe Needleman writes about start-ups, new technologies, and Web 2.0 products, as editor of CNET's Webware. E-mail Rafe.
Recent posts from Webware
Music and browsing take flight in Songbird
BlackBerry's mobile Web site gets a refresh
Zagat on iPhone: 'A disappointment' die-hards will still 'love'
Facebook Marketplace relaunch powered by Oodle
Gmail comes to the desktop in gadget form
Add a Comment (Log in or register) 4 comments
by vidoop April 21, 2008 2:15 AM PDT
Hi Rafe,

Excellent post, I work for Vidoop (http://myVidoop.com) and we are definitely excited to see the usability of OpenID improving. This ID selector is a great step towards making the technology easy for everyone to use. I think with the usability and security advances (e.g. our ImageShield, Verisign tokens, etc.) we have seen, adoption of OpenID by financial and health institutions is not too far away..

-KFox
Reply to this comment
by provis10 April 21, 2008 7:33 AM PDT
Aren't there some incredible data aggregation possibilities created by this method of session initiation? Think DoubleClick, on identity steroids. The operator of a service like this can collect data about not only which websites you use: they also know your preferred identity for each site, which identities you group together, generally who you are, etc.

The commercial "applications" are obvious, as are the implications for privacy and phishing.
Reply to this comment
by bryantcutler April 21, 2008 2:25 PM PDT
A core concept of OpenID is that you trust your Identity Provider at a very fundamental level. They *do* see your authentication transactions, and thus have access to some part of your attention data, but you're already trusting them with your *password* (or key, or cert, or whatever). If you can't trust any of the big providers enough to share those secrets, you can always just run your own OpenID server - there's nothing ClaimID or myOpenID is doing that you can't do yourself, with the JanRain libraries and a functioning server.
by michaelo1966 April 22, 2008 6:41 PM PDT
We're struggling w/ this too. My company, http://www.zvisitor.com, is for both physical and digital security. A consolidated sign-in -- in both the web and IRL -- would be really helpful.
Reply to this comment
advertisement

About Webware

Say No to boxed software! The future of applications is online delivery and access. Software is passé. Webware is the new way to get things done.

Add this feed to your online news reader

Webware topics

In the news now

A tech veteran responds to the recession

LogLogic's Patricia Sueltz heard a clear message about the economy from investors, but she already knows a thing or two about navigating through tough times.


Obama's AG pick on privacy

Eric Holder has criticized the warrantless wiretapping program, but his views on other online policies may not be that far from those of the Bush administration.


advertisement
Click Here

Inside CNET News

Scroll Left Scroll Right