URL based identity with OpenID
Simon Willison, http://simonwillison.net/
Media in Transition, 6th September 2007

The web authentication problem
What username did I use again?
What password did I use again?

The Web needs
Single Sign On

?

SSO with a single
controlling authority
betrays the principles
of the Web

OpenID is decentralised
• An open standard, developed in public
• No controlling authority
• No need to ask permission before
implementing it

An OpenID is a URL
• http://swillison.livejournal.com/
• http://simonwillison.myopenid.com/
• http://simonwillison.net/

Here’s how it works

The sign-up problem

OpenID’s Simple
Registration extension
can help users provide
name, e-mail, D.O.B...

The web profile problem

• Each of these pages has a URL
• If the services supported it, each of these
URLs can be an OpenID
• This lets me assert ownership of my profile
• I can use OpenID to tie profiles together
across multiple sites

The social network problem
• Every site wants to know about my social
network
• Re-friending everyone on every site I visit is
tedious, and a major barrier to adoption
• The Facebook platform lets me reuse the
Facebook social graph - but I have to abide
by their rules

OpenID provides the globally
unique identifier needed to
create a portable social graph

OpenID adoption

0
875
1,750
2,625
3,500
Se
p
'05
O
ct
N
ov
D
ec
Jan
'06
Fe
b
M
ar
Ap
r
M
ay
Ju
ne
Ju
ly
Au
g
Se
p
O
ct
N
ov
D
ec
Jan
'07
Fe
b
Total Relying Parties
M
ar
Ap
r
M
ay
Ju
ne

What’s in it for you?
• Reduces the overhead for signing up for an
account on your service - great for
attracting early adopters
• The ability to “prove” ownership of your
account is an excellent complement to your
service’s Web Service API
• You can learn about a user’s profiles
elsewhere on the Web

Some FAQs
• Does this mean I no longer have a database
of user accounts?
• How do I know that an OpenID is a real
person, and not an evil spammer?
• Isn’t it a bad idea to outsource the security
of my users to a third party?
• What are the privacy implications of this?

http://openid.net/
http://www.openidenabled.com/
http://simonwillison.net/tags/openid/