Bah, I hate OpenID. It's a good idea done totally wrong. The fact that it's tied to another account or OpenID provider really bothers me--IDs should be universal and independent of any "provider", and besides they're still password-based. I think the real direction is this notion of "card-based" authentication, where a "card" is a private key file generated and kept local to your computer and used to authenticate yourself (the private key is never transmitted), but there are some kinks to work out of that system as well (namely, what do you do when you want to access your account from another computer?). Still, it has a lot more "convenience" potential than OpenID, because on systems where you have an authenticated key "card", you don't even need to enter a password at all, the server sends a message to your computer, which you either encrypt or decrypt using your private key, and the opposite is performed on the server using your public key. If it matches, then you're logged-in, all without having to enter a password, which means the remote server is never aware of your password or any sensitive information either! I think it's a great idea, but you still need to allow for password entry if you need to access your account from a non-authenticated computer, though you could disable that for added security if you know you won't need to access it from random/public computers, and then go through the process of authenticating any additional computers you need (by establishing a new private key on that computer, and attaching that new key to your account). I've been doing some thinking on this and I think it's a really great concept!
“Time and space can be a bitch.” –Gushie, Quantum Leap {o,o}.oO( Looking for a great RSS reader? Try FeedBeast! ) |)””’) Built with home-grown CodeProject components! -”-”-
