The single point of failure that you mentioned yourselves is one reason. If the central authentication server fails then all dependent servers have become inaccessable as well.

The second, even more compelling, reason is that if the central system gets compromised then the intruder can find ways to freely obtain id's and subsequently can access any server that relies on the central authentication process. This means that the central authentication service must be protected by extreme measures to provide some level of protection against intrusion.

The third reason is one of trust and accountability. Would you trust the access to your server to a third party controlled authentication process? Now if the third party is under heavy government supervision one might be inclined to accept the risk, but otherwise...

This is why I like public key certificates. It is a decentralized authentication procedure, server and browser only interact with each other. Still the same client certificate can be used to present an ID for as many servers as one likes. The ID carries a digital signature of both the user and a co-signing central root authority which relates to level of trustworthiness. In principle the enduser would need to manage only one client certificate.

Again, I don't wish to be the OpenID advocate, but I appear to be in that role again...

This technology is really only meant to replace the account setup and user email portion of the registration process. The crypto systems employed are to prevent spoofing mostly. The idea is to lower the bar so people can join your site without any effort. Really, if I have to sign up for another forum to make one post I'm going to explode.

If you used your OpenID to log into a bank, the openid is really just in place of the email for the signup. It also transmits a few signup details for you (like email, real name, nickname, etc) and then the bank would ask you to configure a second factor for secure signon. First, they'd have to verify your identity matched, and then they'd ask you to set up another password (a secure one or a USB key, or a certificate or whatever) that you'd use to access your bank software.

So the single point of failure isn't an end user security problem, only a sign-on problem.

What we're having here is a semantic argument about Authentication vs Authorization. They're different, but when we say authentication we usually and implicitly mean both.

-Paul

The NTP Pool and CPAN Ratings are other notable users.

I'm planning to add OpenID support to Bitcard, too. The big advantage/difference with Bitcard is that the email addresses you get from Bitcard will be verified etc already, so you can do away with logic to do that in your application. If you just need an identifier that doesn't change then OpenID is all you need.

- ask