Page: 
Yves
Show profile
Link to this post
In reply to post ID 9491
Akos, you forgot the link in your posting.
Anyway, I've quickly looked into OpenID for half an hour or so now. Here's my summary. Please correct me if necessary.
Instead of entering a username and password to log into a website, you just enter your OpenID URL. This URL leads to an OpenID server that can distinguish between the web services I want to use. The web service asks my OpenID server whether it can get some information about me, which I can accept or deny. If I accept, the web service will know the personal data about me which I otherwise would have entered manually in their register form. (Of course I have first registered with my OpenID server.) To accept such a request, I need to keep the web interface to my OpenID server open in another browser window/tab. When logging into a web service, I am thus interacting with two web sites simultaneously. I must be logged into my OpenID server (through plain old username/password) for it to accept any requests from web services at all. Otherwise anybody (i.e. all web services I use) could log into any web service I use with just my OpenID URL and no password, which wouldn't have to do anything with security.
The key disadvantages of OpenID that I see now are:
Please correct all of my points or I won't see any chance to ever support OpenID. I'm still very much more fond of Microsoft's CardSpace, which is slowly beginning to be available to PHP and with still unclear availability for Firefox or non-Windows platforms. But it doesn't involve any additional web site or centralised provider which holds my personal data, and the PHP library (from Zend) is currently a bit smaller that the one for OpenID. Maybe smaller ones show up in the future since this all still very new.
Anyway, I've quickly looked into OpenID for half an hour or so now. Here's my summary. Please correct me if necessary.
Instead of entering a username and password to log into a website, you just enter your OpenID URL. This URL leads to an OpenID server that can distinguish between the web services I want to use. The web service asks my OpenID server whether it can get some information about me, which I can accept or deny. If I accept, the web service will know the personal data about me which I otherwise would have entered manually in their register form. (Of course I have first registered with my OpenID server.) To accept such a request, I need to keep the web interface to my OpenID server open in another browser window/tab. When logging into a web service, I am thus interacting with two web sites simultaneously. I must be logged into my OpenID server (through plain old username/password) for it to accept any requests from web services at all. Otherwise anybody (i.e. all web services I use) could log into any web service I use with just my OpenID URL and no password, which wouldn't have to do anything with security.
The key disadvantages of OpenID that I see now are:
- You need to either trust an OpenID server (this is where MS Passport failed before, only that you can choose your provider this time) - or be a web site owner yourself with sufficient skills to run your own OpenID server that you can fully trust. This makes a very small number of people who really have an advantage over MS Passport.
- You need to log into your OpenID server at the same time when logging into a forum (or any other web service) using OpenID. This seems very intricate for just checking in for new postings in your lunch break. It also distracts you with a second browser window/tab.
- The PHP code libraries I found were larger than the entire UNB2 code is by now. (Zend's one is somewhere around 130 kB, the official openidenabled code is more than 300 kB!) Why would I use a login system that is twice as complex as a web forum?
Please correct all of my points or I won't see any chance to ever support OpenID. I'm still very much more fond of Microsoft's CardSpace, which is slowly beginning to be available to PHP and with still unclear availability for Firefox or non-Windows platforms. But it doesn't involve any additional web site or centralised provider which holds my personal data, and the PHP library (from Zend) is currently a bit smaller that the one for OpenID. Maybe smaller ones show up in the future since this all still very new.
♪ ...nanananah, all in all we’re just brilliant thieves, nanananah... ♪♬
This post was edited on 2008-02-27, 11:15 by 
)