OpenID

OpenID

An identity system for the Web that lets people use a single username and password to log in and authenticate themselves to OpenID-compliant Web sites. OpenID is a free system that is distributed across the Internet and maintained by numerous organizations, including major sites such as AOL and Yahoo!.

OpenID is also supported in the emerging identity metasystem and can be one of many ID card choices displayed in the card selector's window (see identity metasystem).

Whom Do You Trust?
A major feature of OpenID is that users can decide which OpenID identity provider they trust the most to authenticate them. In fact, users can also become their own identity provider.

The Relying Party Queries the Identity Provider
A Web site that accepts OpenID is known as a "relying party," because it relies on an OpenID identity provider (IdP) for authentication. The OpenID username, called an "OpenID identifier," can be the URL of the provider with username appended, or it can be an XRI i-name. I-names are human-friendly names, such as "=john.doe," that are linked to the OpenID provider, just like domain names are resolved by the DNS system into actual IP addresses on the Internet (see i-name).

When a user logs into an OpenID Web site, the script in the Web page redirects the browser to the identity provider. Using a password or other method, the identity provider attempts to authenticate the user and informs the Web site of its success or failure. For more information, visit www.openid.net. See single sign-on and identity metasystem.

An OpenID Authentication

This is a simplified example of the OpenID authentication sequence. What is not shown is that right after a user logs in, the relying party and identity provider typically share secret keys so that subsequent transactions are more secure.

Hacker-Proof OpenID

Instead of using a fixed password, which can be stolen, the myVidoop OpenID system (www.myvidoop.com) uses a different password each time. When creating a myVidoop account, the user is required to choose several topics. At authentication time, myVidoop displays a group of images that contain those topics in random order. In this example, if the topics were computers, money and cars, the password would be X-H-K for this session only. The next time the user requires authentication, the images and the order change.