chxo internets - Problems with OpenID

A network of memes,
by Chris Snyder

Problems with OpenID

I was considering implementing OpenID for my web apps, but then I saw this review of all the potential problems with it. The article is biased, and some of the arguments aren’t particularly strong, so here’s a short list of the reasons why OpenID is not for me:

Because an attacker knows the url of your login page, he can potentially act as a man-in-the-middle and phish your credentials. This is solvable, but proposed solutions include fairly heroic measures like browser plugins or client certificates.
Your OpenID provider knows exactly which websites you log into, and how often.
Single point of compromise: if your password is sniffed or the provider is haxxored, your identity is stolen for every site on which you used that OpenID. A big OpenID provider is a lucrative target for bad guys.
Single point of failure: if your provider is unreachable, you can’t log into any sites.

It seems a little unfair to pick on OpenID, because these risks are present in any single-sign-on system. Google apps are also famously at risk for the same thing. In fact, using GMail has been creeping me out lately, I cringe a little every time I click a link from email, knowing that the sender knows I’ll be logged in when I do.