Having read the recent news articles from the BBC and others, both Microsoft and Google are joining the single sign on bandwagon, making their users’ id’s OpenID compatible. Both parties will now join the numerous other companies who have already implemented the API into their sites and applications.
“OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience”- OpenID, 2008
By removing the complexity of remembering different usernames and their associated passwords, users should find improved access to services on the web. However, by simplifying the authentication process down to one set of credentials; does this make security a bigger risk, and, will this add further temptation to those willing to unlawfully access enrolled applications for bigger rewards?
The security risks aren’t necessarily eaves dropping or packet sniffing attacks, but, what if a malicious keylogger has been installed on the user’s PC without the user’s knowledge. By the time the user is aware, it may be too late and it could prove very difficult verifying your identity to the service supplier and subsequently regaining access to your profile. But what could happen in the interim? Should you be using an online document package, consider what information is stored on there. If by accessing all these interlinked accounts, could a perpetrator find enough information to pose as yourself to open bank accounts and other services, fraudulently using your identity for financial gain?
OpenID is a very good service which is based on “an open, decentralized, free framework … [OpenID has] arisen from the open source community to solve the problems that could not be easily solved by other existing technologies” (OpenID, 2008). As OpenID isn’t owned by anyone, does this pose an major issue over accountability, should any security breaches occur? Especially when “anyone can choose to be an OpenID user or an OpenID Provider for free without having to register or be approved by any organization” (OpenID, 2008).
The SitePoint article, The Single Sign-On War Will Ruin OpenID, has also been drawn to my attention. The article explains how “Yahoo! and Google — and probably soon Microsoft — are locked in a battle to become the de facto OpenID provider … However, Google and Yahoo! (and likely Microsoft to follow) are ultimately competing with one another to become the branded single sign-on solution for the web”. So will the potential future fragmentation add additional complication to what should be, a simple, open technology?
Recent Comments