6 ms·

Totally understandable, one of the worst executed visions of all times. I think there's a really huge opportunity in this space, and the first who'll be able t

Totally understandable, one of the worst executed visions of all times. I think there's a really huge opportunity in this space, and the first who'll be able to figure out the perfect (and, most importantly, simplest) way to offer a single-sign-on, integrating privacy and security features, will be hugely thanked.

msy 16y ago
That particular holy grail is a poisoned chalice and it's claimed plenty of victims, anyone remember Sxip? It's not a technical problem, it's power, control and ownership. Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. Then there's issues of trust, delegation and longevity. I'd love someone to do it well, I'd love the ability to have anonymous, durable, cryptographically verifiable identities online that could be optionally tied to meatspace identifiers but I just don't see it happening.
- nika 16y ago
  The department of commerce wants to create such an identity system. I'm not sure I like the idea, but it would be "single sign on". I think it is a safe bet that their intention is to eventually make it mandatory, and they have the "ownership", presumed trust, and longevity, not to mention the ability to pass laws "encouraging" adoption. There are probably better news reports out there, but this is what I found with a quick google: http://www.commerce.gov/news/press-releases/2011/01/07/us-commerce-secretary-gary-locke-white-house-cybersecurity-coordinato http://www.commerce.gov/news/press-releases/2011/01/07/us-co...
  - dholowiski 16y ago
    Yet another (scary) example of the U.S. trying to act more like China (with regards to the internet): http://www.futuregov.asia/articles/2010/oct/22/chinas-real-name-register-targets-improper-web-use/ http://www.futuregov.asia/articles/2010/oct/22/chinas-real-n... The previous example being the DHS censoring web sites such as The Pirate Bay and Wikileaks.
  - jarek 16y ago
    That might make it a viable single-identity system. As long as you only want U.S. users.
    - wmf 16y ago
      If NSTIC works, it's likely that other countries will adopt it.
      - jarek 16y ago
        I can already see the early adopters: Russia, China, France, Germany... Even if you do it so that the actual data stores are separate and you manage to keep the APIs the same, lots of countries will have huge issues with adopting U.S. policies.
  - jerf 16y ago
    Putting it in the hands of the government actually fails the trust requirement. Trust is not a binary "this entity is trustworthy", trust is a set of relationships between two entities, and not everyone will trust the US Government, nor will everybody be trusted by the US Government. Even in a perfect world with a perfect US Government, that is the correct answer; not everyone is under US jurisdiction, after all, so we don't even need to get into the political issues. If made mandatory (and the only option), this is a critical failure on the trust front. It can't work, you can't tie your login system to only the US login system, and if you have to have other login systems, US citizens will be able to use those too.
  - rsingel 16y ago
    No, the Department of Commerce wants to help create a standard. It's a damn hard task, but even harder when the net's FUD is the feds want to create an identity system. No, no they don't. And their process is pretty great. But they will fail, in no small part due to FUD, and we'll all be using Facebook Login Plus soon and wondering why we never got an open standard.
  - noss 16y ago
    I wonder how much different their project is to the bank-id and e-legitimation used in Sweden.
- wmf 16y ago
  Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. InfoCard is surprisingly non-evil, and I also think Firefox is ideally placed to work on this (oh look, here's the solution: http://www.azarask.in/blog/post/identity-in-the-browser-firefox/ http://www.azarask.in/blog/post/identity-in-the-browser-fire... ), but they don't seem to care enough.
yock 16y ago
I think the problem lies in how those iedentities are established. A prolific Twitter or Facebook account makes a good identity precisely because you have spent time pouring your identity into it. Your family photos, relationships, residence and work history on your Facebook page. Your daily thoughts and actions cataloged on your Twitter feed. While not perfect, they're the best thing we have right now to externally verify that you are who you claim to be. They provide context to the authentication. Any external service that implemented the authentication standard that may arise out of this situation lacks that identifying context and the best case scenarion only serves to prove that the user authenticating is the user who setup the account. Taking away Facebook's and Twitter's context makes spoofing that authentication much easier. Solving that in a way that doesn't violate the privacy concerns of your users seems like something of a holy grail. Panacea if it exists, but far from demonstrated.
simonw 16y ago
"one of the worst executed visions of all times" What could have been done better? I spent a couple of years advocating for OpenID adoption, because I believed that the alternative (one or two companies controlling login for the entire Web, ala Microsoft Passport or Facebook Connect) would be a massive blow to the decentralised nature of the internet. I believed that OpenID's usability issues could be resolved if enough smart people got involved in figuring them out. Clearly I was wrong on that last point. And yes, my latest project (lanyrd.com) uses Twitter rather than OpenID for authentication. From a developer point of view, that gets me the benefits I hoped for with OpenID (SSO, portable identities, instant contact lists) without having to wait for the world to agree on the standards. I just wish we could have figured out a decentralised solution.
- stumm 16y ago
  Wasn't web finger supposed to fix some of the usability issues with openID? I don't think I ever saw that added, but I could be wrong.
- sloak 16y ago
  Simon, I know the work you and others have done and continue to do in the OpenID world, and it's commendable work. The problem with OpenID and other Open Web work IMO is the sheer number of half-baked specs brought forward. Much more than any other standards group. I don't know why. “The nicest thing about standards is that there are so many of them to choose from,” like Tannenbaum said. Perhaps there is a general lack of attention span, a ohh-shiny problem, a not-invented-here problem that is particularly rampant in this community.
- jdp23 16y ago
  For most users I talk to, an email address (rather than a URL) is how they think of identifying themself in a cross-system way. Orienting the spec around that would have made a huge difference. Were there HCI experts a big part of the community that put together the vision and architecture? How diverse (tech background, language, age) was the original community? Both of those are areas that could have made a big difference. It remains a great vision, so hopefully people will continue to work on it.
lionhearted 16y ago
I was always worried it'd be trivially easy to phish OpenID... I never even signed up for one.
- riffraff 16y ago
  not really. Consider for example yahoo's implementation: when I get redirected to Y! for login, I have my personal login seal on the page that grants me that I am actually talking to yahoo and not some scam site.
  - stonemetal 16y ago
    What about man in the middle?(Go to yahoo get your image and display it for you.) Heck even pass your credentials through to yahoo to verify that you gave me the correct credentials.
    - riffraff 16y ago
      I believe that falls out of the definition of "trivially easy to phish"
lallysingh 16y ago
I don't know why this couldn't be done via the normal RFC process. I can imagine a version of this done with something based (very roughly) on DNS.
- metageek 16y ago
  Oh, yeah. Tie it to email addresses; let any domain publish an SRV record pointing to its ID server. Then all you have to know is your email address, not your OpenID URL.
  - lallysingh 16y ago
    Yeah, or at least an email-looking identifier. I don't think we need to require it to actually receive email -- but it's a fair default.
weavejester 16y ago
I suspect single-sign-on won't take off until we have some browser support for it.
- silverlake 16y ago
  How about Verisign's Firefox extension: https://pip.verisignlabs.com/seatbelt.do https://pip.verisignlabs.com/seatbelt.do
clyfe 16y ago
I think Zed Shaw is on this for some time. http://autho.me/ http://autho.me/
- Raphael 16y ago
  Shouldn't his login page be HTTPS? Or does the cryptography make that redundant?
  - benatkin 16y ago
    That's what he's attempting, and he convinced one skeptic that it might work. http://news.ycombinator.com/item?id=2083774 http://news.ycombinator.com/item?id=2083774 http://www.curated.by/splaice/zed-shaw--dan-kaminsky-talk-about-authome http://www.curated.by/splaice/zed-shaw--dan-kaminsky-talk-ab...
  - zedshaw 16y ago
    I actually don't have HTTPS on autho.me on purpose to make sure nobody uses it for anything serious. When I get serious about it it'll be SSL encased properly. This also lets you dump the protocol and watch what I'm doing so that you can make sure the SRP is not sending your password and information. And I need to get back to working on that.

msy 16y ago

That particular holy grail is a poisoned chalice and it's claimed plenty of victims, anyone remember Sxip? It's not a technical problem, it's power, control and ownership. Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. Then there's issues of trust, delegation and longevity. I'd love someone to do it well, I'd love the ability to have anonymous, durable, cryptographically verifiable identities online that could be optionally tied to meatspace identifiers but I just don't see it happening.

nika 16y ago
The department of commerce wants to create such an identity system. I'm not sure I like the idea, but it would be "single sign on". I think it is a safe bet that their intention is to eventually make it mandatory, and they have the "ownership", presumed trust, and longevity, not to mention the ability to pass laws "encouraging" adoption. There are probably better news reports out there, but this is what I found with a quick google: http://www.commerce.gov/news/press-releases/2011/01/07/us-commerce-secretary-gary-locke-white-house-cybersecurity-coordinato http://www.commerce.gov/news/press-releases/2011/01/07/us-co...
- dholowiski 16y ago
  Yet another (scary) example of the U.S. trying to act more like China (with regards to the internet): http://www.futuregov.asia/articles/2010/oct/22/chinas-real-name-register-targets-improper-web-use/ http://www.futuregov.asia/articles/2010/oct/22/chinas-real-n... The previous example being the DHS censoring web sites such as The Pirate Bay and Wikileaks.
- jarek 16y ago
  That might make it a viable single-identity system. As long as you only want U.S. users.
  - wmf 16y ago
    If NSTIC works, it's likely that other countries will adopt it.
    - jarek 16y ago
      I can already see the early adopters: Russia, China, France, Germany... Even if you do it so that the actual data stores are separate and you manage to keep the APIs the same, lots of countries will have huge issues with adopting U.S. policies.
- jerf 16y ago
  Putting it in the hands of the government actually fails the trust requirement. Trust is not a binary "this entity is trustworthy", trust is a set of relationships between two entities, and not everyone will trust the US Government, nor will everybody be trusted by the US Government. Even in a perfect world with a perfect US Government, that is the correct answer; not everyone is under US jurisdiction, after all, so we don't even need to get into the political issues. If made mandatory (and the only option), this is a critical failure on the trust front. It can't work, you can't tie your login system to only the US login system, and if you have to have other login systems, US citizens will be able to use those too.
- rsingel 16y ago
  No, the Department of Commerce wants to help create a standard. It's a damn hard task, but even harder when the net's FUD is the feds want to create an identity system. No, no they don't. And their process is pretty great. But they will fail, in no small part due to FUD, and we'll all be using Facebook Login Plus soon and wondering why we never got an open standard.
- noss 16y ago
  I wonder how much different their project is to the bank-id and e-legitimation used in Sweden.
wmf 16y ago
Anyone in a position to allow a platform to get serious traction isn't going to give that control up and anyone that isn't can't make a system with enough traction. InfoCard is surprisingly non-evil, and I also think Firefox is ideally placed to work on this (oh look, here's the solution: http://www.azarask.in/blog/post/identity-in-the-browser-firefox/ http://www.azarask.in/blog/post/identity-in-the-browser-fire... ), but they don't seem to care enough.

yock 16y ago

I think the problem lies in how those iedentities are established. A prolific Twitter or Facebook account makes a good identity precisely because you have spent time pouring your identity into it. Your family photos, relationships, residence and work history on your Facebook page. Your daily thoughts and actions cataloged on your Twitter feed. While not perfect, they're the best thing we have right now to externally verify that you are who you claim to be. They provide context to the authentication. Any external service that implemented the authentication standard that may arise out of this situation lacks that identifying context and the best case scenarion only serves to prove that the user authenticating is the user who setup the account. Taking away Facebook's and Twitter's context makes spoofing that authentication much easier. Solving that in a way that doesn't violate the privacy concerns of your users seems like something of a holy grail. Panacea if it exists, but far from demonstrated.

simonw 16y ago

"one of the worst executed visions of all times" What could have been done better? I spent a couple of years advocating for OpenID adoption, because I believed that the alternative (one or two companies controlling login for the entire Web, ala Microsoft Passport or Facebook Connect) would be a massive blow to the decentralised nature of the internet. I believed that OpenID's usability issues could be resolved if enough smart people got involved in figuring them out. Clearly I was wrong on that last point. And yes, my latest project (lanyrd.com) uses Twitter rather than OpenID for authentication. From a developer point of view, that gets me the benefits I hoped for with OpenID (SSO, portable identities, instant contact lists) without having to wait for the world to agree on the standards. I just wish we could have figured out a decentralised solution.

stumm 16y ago
Wasn't web finger supposed to fix some of the usability issues with openID? I don't think I ever saw that added, but I could be wrong.
sloak 16y ago
Simon, I know the work you and others have done and continue to do in the OpenID world, and it's commendable work. The problem with OpenID and other Open Web work IMO is the sheer number of half-baked specs brought forward. Much more than any other standards group. I don't know why. “The nicest thing about standards is that there are so many of them to choose from,” like Tannenbaum said. Perhaps there is a general lack of attention span, a ohh-shiny problem, a not-invented-here problem that is particularly rampant in this community.
jdp23 16y ago
For most users I talk to, an email address (rather than a URL) is how they think of identifying themself in a cross-system way. Orienting the spec around that would have made a huge difference. Were there HCI experts a big part of the community that put together the vision and architecture? How diverse (tech background, language, age) was the original community? Both of those are areas that could have made a big difference. It remains a great vision, so hopefully people will continue to work on it.

lionhearted 16y ago

I was always worried it'd be trivially easy to phish OpenID... I never even signed up for one.

riffraff 16y ago
not really. Consider for example yahoo's implementation: when I get redirected to Y! for login, I have my personal login seal on the page that grants me that I am actually talking to yahoo and not some scam site.
- stonemetal 16y ago
  What about man in the middle?(Go to yahoo get your image and display it for you.) Heck even pass your credentials through to yahoo to verify that you gave me the correct credentials.
  - riffraff 16y ago
    I believe that falls out of the definition of "trivially easy to phish"

lallysingh 16y ago

I don't know why this couldn't be done via the normal RFC process. I can imagine a version of this done with something based (very roughly) on DNS.

metageek 16y ago
Oh, yeah. Tie it to email addresses; let any domain publish an SRV record pointing to its ID server. Then all you have to know is your email address, not your OpenID URL.
- lallysingh 16y ago
  Yeah, or at least an email-looking identifier. I don't think we need to require it to actually receive email -- but it's a fair default.

weavejester 16y ago

I suspect single-sign-on won't take off until we have some browser support for it.

silverlake 16y ago
How about Verisign's Firefox extension: https://pip.verisignlabs.com/seatbelt.do https://pip.verisignlabs.com/seatbelt.do

clyfe 16y ago

I think Zed Shaw is on this for some time. http://autho.me/ http://autho.me/

Raphael 16y ago
Shouldn't his login page be HTTPS? Or does the cryptography make that redundant?
- benatkin 16y ago
  That's what he's attempting, and he convinced one skeptic that it might work. http://news.ycombinator.com/item?id=2083774 http://news.ycombinator.com/item?id=2083774 http://www.curated.by/splaice/zed-shaw--dan-kaminsky-talk-about-authome http://www.curated.by/splaice/zed-shaw--dan-kaminsky-talk-ab...
- zedshaw 16y ago
  I actually don't have HTTPS on autho.me on purpose to make sure nobody uses it for anything serious. When I get serious about it it'll be SSL encased properly. This also lets you dump the protocol and watch what I'm doing so that you can make sure the SRP is not sending your password and information. And I need to get back to working on that.