PlusNet Community Website

I read Dion Almaer’s post about moving the responsibility for authentication from the website into the web browser itself with great interest. More…

1 Comment »

Clickpass has just launched a new OpenID offering which aims to make single sign-in easy enough for the masses. It takes a rather different approach to OpenID than other sites I have tried. The first obvious difference is that sites must, in addition to supporting OpenID, add a special Clickpass button to their sign-in screen. Behind the scenes it also generates a new, unique OpenID URL for each site you use. This is an interesting extra layer of privacy as it makes you completely unidetifiable to the relying party (i.e. the website you are signing in to). I gave it a whirl with Plaxo but was shocked to find that upon clicking the Clickpass button I was taken to a page on clickpass.com which asked me for my Plaxo username and password!

Carsten Pötter has a more in depth post on this bizarre behaviour of Clickpass. He ends with this thought:

There have to be better solutions for making the OpenID experience more comfortable for mainstream users. OpenID is here to overcome the password dilemma of many people, even trying to be more secure. Giving away passwords to third party sites is contradictory and is giving the wrong signal to users.

A comment on that post from Clickpass boss Peter Nixey goes some way to explaining why they chose to do it that way:

We spent a lot of time talking about the ‘asking users for passwords’ problem. In actuality we don’t even pass the credentials through our server - they are submitted directly to the relying party but nonetheless is would be better not to ask for them at all.

It’s true that the form goes direct to the server of the relying party (it is used to send them the randomly generated OpenID URL) but how is anyone to know that? Half the point of OpenID is avoiding sharing passwords between sites. Most users probably wouldn’t think twice about entering their private login details into a third-party site (especially when presented as part of a login process) but that is exactly the kind if blind trust that we, as conciencious web developers, should be educating against.

Ultimately though I think Clickpass’s biggest problem will be getting sites to implement their special button. There are few enough sites that accept standard OpenIDs.

2 Comments »

It’s Thursday again. A quick update on our progress:

Paul has been playing with our current implementation: He now has a Plusnet OpenID, delegated it via his blog, and successfully logged into his Basecamp account using it. He’s happy!

Colin has been taking a look to see if the current server we are using will support OpenID2, which is appears not to do :(.

After reviewing those other implementations last week, Tam has been experimenting with some prototypes for how we could implement it on our portals and community site. We’ll show you them when we’ve got something together!

Finally, I’ve been looking at Phishing with OpenID and Google has a whole host of links. Scary stuff.

Anyway, I think it’s home time!

1 Comment »