OpenID Adventures

Someone wrote an OpenId logon control for ASP.NET–very handy, since communicating with an OpenId server is an nontrivial tasks. But, the control was written in the .NET language Boo. This would be all fine and good, but the implementation is buggy (or some OpenID servers are buggy.) and I can’t fix bugs written in Boo. Currently, I’m dealing with the issue where the OpenID client and server can’t decide if Http://foo.com is the same as http://foo.com:80 Presumably it work work if I was using the SSL port, but I haven’t spent money on a certificate yet.

ClaimId’s profile management is buggy, but at least ClaimId thinks http://foo.com is the same as http://foo.com:80 whereas MyOpenId.com thinks they are different.

I can forecast that OpenId will go the same way as HTTP, potentially very successful, but writing the logon control will become increasingly complicated to compensate for the millions of different ways that servers implement the OpenId specs. And servers will likely become extremely difficult to implement to deal with the large number of ways clients implement the spec.

Sigh. It’s enough to make me look at CardSpace again. One of the key benefits I saw in OpenId was that it didn’t require SSL to be working–so I thought. Now it seems that both technologies really are intended to be heavily dependent on a fully functioning layer of SSL.

You want your site to support password-less logon, you’re going to have to buy an SSL certificate. What is really depressing about that, is that the web 2.0 model for authentication will be stuck in the business model for web 1.0, where we all give money to Verisign and get in return certificates that website users don’t understand very well. And with the large number of sites with SSL certs that are legitimate companies but have expired SSL certs and slightly mismatched URLs, or self signed certificates, what few people do pay attention to the little lock icon now know to ignore it entirely.

So Microsoft, where is the HTTP solution for authentication? I’m not about to buy an SSL certificate for managing comments to my blog.