{"id":609,"date":"2006-10-10T20:37:18","date_gmt":"2006-10-11T04:37:18","guid":{"rendered":"\/?p=609"},"modified":"2006-10-10T21:37:06","modified_gmt":"2006-10-11T05:37:06","slug":"bbauth-and-openid-move-identity-forward","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=609","title":{"rendered":"BBAuth and OpenID move identity forward"},"content":{"rendered":"

I read this piece<\/a> by Scott Kvelton<\/a> and wanted to make it clear that my concerns about user experience when using protocols that redirect you from site to site to site were not meant to put down the positives<\/strong> that both those technologies represent. <\/p>\n

I think BBAuth and OpenID both move identity forward.  Count me in as a supporting that.<\/p>\n

I<\/font><\/a>‘m just saying that I think we should co-operate to fix the redirection user experience, and replace it with something that is way less phishable. <\/p>\n

Scott says:<\/p>\n

Lots and lots<\/a> and lots<\/a> and lots<\/a> of discussion going on regarding BBauth<\/a> and OpenID<\/a> <\/p>\n

Kim Cameron<\/a> had an interesting post<\/a> today concerning the interface issues with BBauth as well as OpenID:<\/p>\n

My concerns really originate with the user interface issues. And OpenID has the same problems to the extent that people end up with multiple identity providers (which they will).<\/div>\n

I appreciate Kim\u00e2\u20ac\u2122s passion about InfoCards and the concept of a consistent user interface. I think its a fantastic idea. So let\u00e2\u20ac\u2122s be pragmatic about it. We\u00e2\u20ac\u2122re here today: no consistent user interface, lots of usernames and passwords and phishing is a huge problem. We want to get here: consistent user interface, one username and password and phishing becomes a thing of the past. Great. Where do we start? I don\u00e2\u20ac\u2122t think InfoCard is the answer. Let me explain.<\/p>\n

How do we know InfoCard provides a great interface for users? When I first saw and used an InfoCard it freaked me out. \u00e2\u20ac\u0153What the heck is popping onto my screen?!\u00e2\u20ac\u009d Talk about a paradigm shift. Answering the this-is-a-great-user-interface question is an iterative process. It takes time and lots and lots of user input.<\/p><\/blockquote>\n

My answer?  You build interfaces and test them.  You look at the numbers.  You test phishing approaches on a wide assortment of people.  You find out what works and doesn't, and keep evolving the interface.  If we take this as a starting point, we'll all end up agreeing.<\/p>\n

The problem with redirection within the conventional browser is there is no way to know for sure where you've ended up – especially if you aren't a network engineer. <\/p>\n

The fact is we have no idea how users are going to use user-centric identity so how can we make assumptions about the user interface today that aren\u00e2\u20ac\u2122t iterative?<\/p>\n

But if this type of SSO were to become a massive success, that success would bring about its downfall. For it would then be worth attacking and very vulnerable at the same time.<\/div>\n

If something like OpenID or BBAuth takes off, there won\u00e2\u20ac\u2122t be a downfall. The platform will continue to evolve and get better. Is InfoCard the final and complete answer? We have no idea. The real question is which platform is best suited to constant evolution? Like Kim is a broken record about InfoCards (his words, not mine), I\u00e2\u20ac\u2122m the same way about OpenID \u00e2\u20ac\u00a6 \ud83d\ude42 I believe OpenID is best suited to this kind of evolution.<\/p><\/blockquote>\n

Sorry – the redirection aspect of the incremental UI is still, in my view, vulnerable.  None the less it's a step forward from where we are today.  I'm not arguing that InfoCard is the final word on anything.  I'm arguing that it helps you deal with multiple identity providers, eliminates “redirection attacks”, prevents the evil site from being in control of the user experience.  Surely these can't be seen as bad things?  OpenID could take advantage of them by including support for that interface.<\/p>\n

Kvelton concludes: <\/p>\n

OpenID is incremental by its nature. Its not a quantum leap. Its a URL. Users today are starting to think more and more in terms of URL\u00e2\u20ac\u2122s \u00e2\u20ac\u00a6 just ask a MySpace or blog user (I have cold hard data on this one; my babysitter is a MySpace user). Its iterative. We\u00e2\u20ac\u2122re not trying to boil the ocean in the first go at this. We don\u00e2\u20ac\u2122t know how users are going to use this thing. So let\u00e2\u20ac\u2122s make the fewest number of assumptions for the users before we deliver something. Watch how they use it, find out what makes sense. Repeat.<\/p><\/blockquote>\n

A lot of users will be fine with URLs for their public personas.  But I fear they can still be phished during redirection.<\/p>\n

Is BBauth, CardSpace or OpenID the end-all-be-all solutions for single sign-on? Definitely not today. One thing is clear though; companies and users alike are seeing the value of user-centric identity and its slowly but surely happening; CardSpace, OpenID and BBauth are clear indications of this. This stuff doesn\u00e2\u20ac\u2122t happen overnight but the ship is slowly turning in the right direction.<\/p><\/blockquote>\n

There is wisdom in this.  But if Kvelton is against giving the InfoCard visual metaphor a try, then I don't get it.  It does nothing to undermine OpenID.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

A lot of users will be fine with URLs for their public personas. But I fear they can still be phished during redirection.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,6,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/609"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=609"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/609\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}