Comments on: Passwordless MyOpenID http://blog.jonudell.net/2007/12/04/passwordless-myopenid/ Strategies for Internet citizens Sat, 11 Feb 2012 19:45:11 +0000 hourly 1 http://wordpress.com/ By: steve http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-123133 Thu, 17 Apr 2008 16:30:17 +0000 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-123133 The team I work with has created a password-less provider service that binds a users account to an strong authentication devices, such as a smart card, fingerprint reader, or USB token:

https://openid.trustbearer.com

]]> By: Jon Udell http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101472 Fri, 07 Dec 2007 17:49:18 +0000 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101472 “How well will OpenID retrofit?”

My hope is that for OpenID, and also CardSpace, we’ll find that over time sites offer us the option to migrate from name/password to these other mechanisms.

Right now, you’d be the oddball service if you offered an alternative, so there’s no peer pressure to do it. But when things tip, you’ll be the oddball for not offering alternatives. Then you’ll feel that pressure, and will want to do something about it.

]]> By: TX972 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101457 Fri, 07 Dec 2007 17:33:35 +0000 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101457 How well will OpenID retrofit? Those of us who have been using the internet for a couple of years or more must have accumulated a hundred of more sites that require User ID/Password. Will OpenID retrofit these?

Rhapsody, Yahoo, email servers, medical insurance site, Youtube, Digg, FlightAware, Slacker, Netflix, Myspace, Hotwire, eBay, university site, MetaFilter, MarketScreen.com, Raging Bull, Sirius Radio, etc., etc.

There are strategies for handling all these passwords — mostly to use one ID as often as possible and to record all IDs to a word document the name of which is well camouflaged, so as to be of minimal interest to any possible hacker.

If OpenID can not adapt to dozens/hundreds of existing IDs, then I’m afraid it just gets added to the list of one more site’s passwords. One other concern is how well OpenID’s server is protected from intruders. My computer is just one of many millions. Chances are pretty low that I’ll be randomly hit by a hacker. OpenID is out there labeled as a site containing LOTS of passwords. That’s so much more attractive to hackers than my one measly computer. Do I want to open myself to that magnitude of a risk of computer-identity theft?

]]> By: Jon Udell http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101302 Fri, 07 Dec 2007 12:31:40 +0000 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-101302 “there are pretty serious security issues with it, both at the technical level, and at the social-engineering level.”

Which is why marrying OpenID with a passwordless identity selector is helpful.

]]> By: martin langhoff http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-99756 Wed, 05 Dec 2007 00:36:26 +0000 http://blog.jonudell.net/2007/12/04/passwordless-myopenid/#comment-99756 When discussing OpenID it is important to note that there are pretty serious security issues with it, both at the technical level, and at the social-engineering level. While looking at implementing it for Moodle on the OLPC school server, I’ve had some discussions with Ben Laurie (author of the Apache SSL module, and well versed in PKI and similar arcana).

See the discussion here
http://lists.laptop.org/pipermail/server-devel/2007-July/000083.html and Ben Laurie’s notes at http://www.links.org/?p=187 and his later blogposts.

]]>