Johannes Ernst’s Blog

OpenID wins WebWare 100 Award

Just after bagging the NextWeb award, OpenID is now also a WebWare 100 winner. Of course, we knew that all along. Glad that CNet’s readers agree ;-)

Other winners in the same category:

  • Firefox
  • Google Reader
  • Internet Explorer 7
  • My Yahoo
  • Netvibes
  • OpenID
  • Opera
  • Safari
  • StumbleUpon
  • yourminis

Sun’s OpenID Provider is On-line

Pat has a description, and Hubert outlines the server architecture.

The site itself is at OpenID.sun.com.

On Burton Group User-Centric Identity Briefing Today

Mike Jones (Microsoft), Paul Trevithick (Higgins Project) and myself participated in a Burton Group tele-briefing today. Burton Group is a well-respected analyst firm that has spent probably more time than any other analyst firm on digital identity. They also host the upcoming Catalyst conference.

I had the opportunity to give a brief overview over user-centric identity and why it matters to businesses’ bottom line. We then talked about its primary approaches — identifier-based (OpenID) and card-based (information cards)— and attempted to explain why interoperability is important, and how the upcoming user-centric interop workshop at Catalyst will help demonstrate that these new technologies are becoming adoptable.

In the second section, Hal Lockhart (BEA) and Rich Levinson (Oracle) talked about XACML.

There is a replay of the briefing tomorrow morning, with an opportunity to ask live questions. If you are a Burton Group client, please do feel to listen in.

Where’s the Biggest Privacy Problem Related To On-Line Identity?

OpenID has seen its share of critics who are concerned that their OpenID Provider may collect too much information about them (recent example).

In a recent story titled "Which ISPs Are Spying on You?", Wired Magazine now points out a much bigger, and much more immediate privacy problem: privacy policies, or lack thereof, at big internet service providers.

Let’s do a quick comparison:

  ISP OpenID Provider
Has access to: All of your activities on-line including every single click you make with a browser, regardless of which site you visit. Only authentication transactions, and only the subset for which you used this particular OpenID provider. This easily translates into a 100-to-1 difference in data volume for privacy-relevant data.
Your choice as a customer: Stay off-line, given that you typically have few (<10 or less) choices of competitive broadband providers in your area, none of whom will compete based on better privacy policies any time soon. 1. Go do a different OpenID Provider, or several of them. There are plenty to choose from.
2. Run your own OpenID provider, by yourself or with your friends. No permission is required from anybody.
And government surveillance? Your ISP always does business in the jurisdiction in which you live, so you are subject to whatever laws that may give the local government access to your records, perhaps without you ever finding out. You find an OpenID Provider in a jurisdiction that has stronger privacy laws and privacy practices than wherever you happen to live.

I do not mean to downplay the risk that your favorite OpenID provider may “go bad” and does nasty stuff with your data. However, in the grand scheme of privacy, I’m personally much more concerned about credit card transactions, say, entirely unprotected credentials such as your social security number, and as described in the Wired article, the tremendous amount of information your internet service provider probably already collects about every one of us.

I was hoping somebody would attempt to write this kind of article, and I’m very glad Ryan Singel did. The even worse story is how little information they actually managed to obtain from these big ISPs, and I’m sure he did try!

OpenID Wins NextWeb Award

This is significant. Look at the other winners:

Entertainment: YouTube
Company: Yahoo!
Social: LinkedIn
Search: WikiPedia
Disruptors: OpenID
Web Celeb: Tariq Krim
Beta & Stealth: Joost
Populizr: TechCrunch

That’s great company. Also, "disruptors" seems like the exact right category for it.

Time for everybody to figure out how not to be disrupted, or use it to disrupt the competition …!