More sign-ups for OpenID

January 20, 2008

Hot off the back of Yahoo! implementing OpenID, Google goes and does the same.  OpenID is an identity/authentication system, much the same as Windows Live ID is.

As many commenters have said, this is a good thing for the project, and for security in general.  Although generally it’s considered "bad" to have a single accounts/sign-in for multiple systems (a breach in one means that all others could be compromised), it’s sometimes better to consolidate functionality where one knows it operates correctly.  The more code we can shift to libraries/services that have already been fully reviewed and QA’ed, the better.  Take cryptography for example – no-one in their right mind writes a new crypto library/function.  You use the ones that already exist because it’s less effort, and less prone to mistakes (through peer review and QA).  Leave developing "new" ones to the experts.

Any federated identity/authentication system is prone to issues, not only because of the complexity of the system, but also because it is a very likely place to attack based on the .  OpenID appears to be pretty good (I’ve not had a serious look at is as yet), but there’s still some major issues [PDF link] with the system.  The main technical one is to do with phishing and man-in-the-middle attacks (the rogue/malicious identity provider), whereas others revolve around privacy and usage issues.

I’m really not too sure how I feel about OpenID.  In some ways I like that there’s an alternative to LiveID/CardSpace/Passport, but in the limited review I’ve done on both system, OpenID doesn’t seem to be as secure or as well thought out.  Microsoft have said that they would support OpenID, but I’ve not seen them actually do this yet.  They certainly wont be a consumer of OpenID’s, but I can’t see it’s terribly difficult for them to be a provider.

The one thing I will add to this topic is that all of these system rely on single factor authentication – just username and password.  Some systems try and "fake" two factor through the use of user-provided images (like BoA’s SiteKey, which has it’s own issues).  What I would like to see in any shared identity/authentication, perhaps as an option that I’d pay a premium for, is system which uses things like RSA Tokens, smart cards, in order to add to the overall security.  Many other organizations (McAfee/Foundstone included) and even some sites (ETrade for example with certain accounts), so I think it’s probably a very simple value-add.  It wouldn’t entirely remove the issues I’ve pointed to above, but would make breaking such systems more difficult and limit the exposure of some attacks.

Posted in Industry