4 ms·

Personally I don't like any of these global logon initiatives. I don't use Stackoverflow because I never found a way to login without using OpenID. Since I do

Personally I don't like any of these global logon initiatives. I don't use Stackoverflow because I never found a way to login without using OpenID. Since I don't like a bunch of random web sites being able to connect me so easily, to use Stackoverflow I would have to go to one of those openID sites and make a fake account or set up my own OpenID provider. Both of these options are extremely inconvenient. I'm used to having a different user id/password for every site I have an account on so that's very easy for me. I haven't looked into the technical details deeply but people keep talking like OpenID is safe. I assume sites that use OpenID never see my user name and password but what if the site says that it uses OpenID but actually just stores my user name and password? Would I have any way of recognizing that the site was using fake OpenID?

sbierwagen 16y ago
Perhaps you should try something before you dismiss it. Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provider will never store your password in cleartext, so they won't know it either.) The only thing the site knows is your OpenID url, and when you sign in using that, it redirects you there, to enter your password. Live example. I use myopenid.com to provide OpenID services, delegated via a link rel="openid.delegate" tag on my personal site, bbot.org. When I want to sign in via OpenID on a site, say, livejournal, I type in "bbot.org". Livejournal looks at that site, reads the link tag, and sends me to myopenid.com. I sign in there, and it sends me back to livejournal, now logged in.
- loewenskind 16y ago
  Ok, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right? In that case I guess I can live with it. I'll just have to go to the effort of setting up my own openID provider since I still don't want different sites tying my ID together so I'll have to set something up on my side. This is all a lot more effort than it was before and I don't see any benefit at all to how I use the internet. But thanks for giving a detailed explanation of how it works. At least my security concerns are lessened (still, compromising one site and logging passwords will compromise every site you use this service with).

sbierwagen 16y ago

Perhaps you should try something before you dismiss it. Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provider will never store your password in cleartext, so they won't know it either.) The only thing the site knows is your OpenID url, and when you sign in using that, it redirects you there, to enter your password. Live example. I use myopenid.com to provide OpenID services, delegated via a link rel="openid.delegate" tag on my personal site, bbot.org. When I want to sign in via OpenID on a site, say, livejournal, I type in "bbot.org". Livejournal looks at that site, reads the link tag, and sends me to myopenid.com. I sign in there, and it sends me back to livejournal, now logged in.

loewenskind 16y ago
Ok, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right? In that case I guess I can live with it. I'll just have to go to the effort of setting up my own openID provider since I still don't want different sites tying my ID together so I'll have to set something up on my side. This is all a lot more effort than it was before and I don't see any benefit at all to how I use the internet. But thanks for giving a detailed explanation of how it works. At least my security concerns are lessened (still, compromising one site and logging passwords will compromise every site you use this service with).