OpenID’s slow adoption

On Friday I had a quick Twit with Uno on why the adoption of OpenID is soooo slow. We were limited by time and Twitter’s word count so it did not go on for too long. I was actually wrong in that conversation. I stated that it was being overcomplicated and thats the reason why non-technical people don’t use it.

Later on I thought, what a “twit”! The main reason for its slow adoption is due to limited support in online services. If more big sites support it, more people will start implementing it. There is currently little value for users to use OpenID, since 9 out of 10 times they will have to sign up at a web site with a normal username and password anyway since that site does not support OpenID. Simple as that. Technical folks all have an OpenID because they see the future value of it and they like the concept.

What we must look at is why so many sites are not implementing it. When I implemented it for Afrigator I found that there is very little support or examples of how others before me have done it and I had to go very much into the technicalities of how the protocol actually works. There was at that stage 2 libraries for PHP that one could re-use for your own apps. There might be more now, but not sure. I think Python has a little more libraries, but not to sure about that fact.

Our very own Armand du Plessis is involved in a very, very interesting project which allows people to use their Facebook logins as an OpenID provider. It is called Identitude. I applaude this effort as it not only is extremely useful, but it also creates a great awareness of the OpenID technology. Great job Armand! Here is a great post explaining most of it.

Blogged with Flock

Tags: openid, facebook, identitude

4 Comments to "OpenID’s slow adoption"

• Armand du Plessis said: On 08/21/2007 at 9:53 am

  Thanks for the link I haven’t had as much time as I would’ve liked the past two weeks to work on it but if all goes well there should be a significantly updated build up either this evening or at the latest by the weekend and a post to explain the new functionality to go with it.
  Over the next couple of weeks I’ll also change it from a prototype that only really makes sense to people that understands OpenID to something more widely accessible

  And I agree with you, there’s been a lot of talk the past couple of days over OpenID being too complicated and confusing. But email used to be the same. Still today if you try and explain pop3, smtp or imap to someone they would probably look at you strange but that doesn’t stop the majority of the worlds population from using it. As soon as more sites supports OpenID and people start getting used to it, the focus will start shifting away from the technicalities of the OpenID specs and protocols to the value of using something really useful.

• Stii said: On 08/21/2007 at 11:08 am

  Well said, Armand. You are exactly 100% right. Any new technology is, well, new and complicated.

• Twylite said: On 08/22/2007 at 7:29 am

  In a nutshell: OpenID is insecure and overly complex.

  OpenID is subject to multiple points of attack including DNS forgery against the server, modifying files on your web host, and various script attacks against your browser. CSRF attacks will probably make OpenID an all-areas pass to your online accounts.

  The insecurity stems in part from relying on the security of DNS (bad idea), in part from the complexity of the protocol and protocol model (which make threat modeling difficult), and in part from the idea that a common web host becomes a Trusted Third Party.

  In short, no-one who has any intention of keeping their online accounts accessible to themselves only should be using OpenID for anything, ever.

• Stii said: On 08/23/2007 at 8:26 am

  Interesting, Twylite. I do however still think it is a great idea! Yes, there are dangers and attacks behind it (like phishing, etc). That does not mean we should drop it completely! There are dangers using your credit card online. That does not stop us from doing it. We hope and pray they make it secure enough so our details do not get stolen… Well, I’ll keep on supporting it as I love the idea and philosophy behind it!

  I do agree that it is somewhat overly complex! Sometimes I get the feeling that people think making things complex is a solution to security risks…

Spit it out!

Filed in: Kick-ass Tools, Semantic Web, Social Web by: Stii