Live data from Hacker News

Coding Horror: Your Internet Driver's License

codinghorror.com

11–20 of 101 posts

Re: Coding Horror: Your Internet Driver's License

#11
post #9

Isn't one of the main benefits and best things about the internet is anonymity? Obviously FB and Twitter have information about my real identity, but why would Instapaper, or Reddit? Having a global login takes away that anonymity.

There's nothing stopping you from using an anonymous Twitter account to login if the site supports Twitter authentication.

Alternatively, MyOpenID and some other OpenID providers allow you to choose what pieces of data to present to the requesting site when asking you for permission to authenticate with them.

Facebook is another story, as they want every profile to correspond to a real-life human and only present an allow/deny choice for permissions to the requesting site instead of finer-grained access control.

Re: Coding Horror: Your Internet Driver's License

#12
post #2

I am not sanguine on the idea, but the marketing for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driv…

I agree he's not selling it properly, but I would also say it's not actually that different to everything coming back to my email inbox and being remembered by my browser either. For me it's not a problem, perhaps for admins it is, which reminds me of the incessant caterwauling we used to have about "the spam problem" (which was often a mask for the micropayments movement). And people should reach for their gun when they hear people blabbering about ID centralisation, that's a good reaction. And considering there is a happy-go-lucky Belgian linking it to the government in the comments, I'd say they are right in some sense, it will embolden those who want the government to control everything on the Internet.

Re: Coding Horror: Your Internet Driver's License

#13
post #9

Isn't one of the main benefits and best things about the internet is anonymity? Obviously FB and Twitter have information about my real identity, but why would Instapaper, or Reddit? Having a global login takes away that anonymity.

The ability to be anonymous is an important one and should always remain available, but in general day to day usage anonymity is only used by people who don't want to take responsibility for their own actions (or words).

I see no problem with tying my offline identity to my online one.

Besides, if you wanted to disconnect the identities you just create multiple OpenIds for each identity you want to act out.

Re: Coding Horror: Your Internet Driver's License

#14
post #5
post #3

Something about using one set of credentials for a bunch of unrelated sites rubs me the wrong way. I think it has something to do with what commenter Kevdog said: > Here's where the driver license analogy breaks down: I have physical control over my license, it stays with me. No one can lose my license for me.

You can be fully in control of your own OpenID if you want. Just host it on your own domain/server. Or even easier: use delegation. Add some meta tags to the header of your blog (or any HTML page under your control), and sign up for sites using your blog URL as your OpenId. See an example at my domain (the content is currently blank, but the meta tags are in the source code): http://jmh.id.au I can sign up anywhere b…

I have multiple problems with this answer.

The first is practical: you are not qualified to run OpenID on your server. Really, you're not. I'm not and I have actually implemented both OpenID providers and Relying Parties for clients before, at the old day job. If you run OpenID, you are exposed to every threat your OpenID provider is currently vulnerable to in perpetuity, unless you make it your mission in life to stay up to date on OpenID security. The people who actually do that missed a timing attack which compromised the security of nearly every OpenID-using system on the Internet. You will not do better than they did.

The second reason this is bad advice is because OpenID has a feature which should make it unnecessary: delegation, which lets you nominate any OpenID provider on the Internet as "your" provider. You are theoretically able to change that after having done it, so if you want to move your identity from Google to Yahoo you can. Delegation is a misfeature. It makes the OpenID spec roughly ten times more difficult to understand than it already was. Very few people implement delegation correctly -- of particular notice, very few relying parties implement it correctly, which means that when you come back in a few years with the same OpenID but a different underlying provider they have no recollection of you at all. That is a pretty bad failure mode for a federated authentication system, and many relying parties coded by smart people walk straight into it.

Then we come to the real meat of the matter: for an authentication system to be useful, you have to be able to use it without being able to implement it. OpenID is a user experience nightmare for non-technical users. Just the experience of actually logging in is bad enough. It also teaches your users to fall for phishing attacks against their holiest of holy credential, because every sane person uses OpenID through their email provider and OpenID teaches you that you can go to any random site, the screen is going to flash, and then you should type in your email address and password. This is phishing heaven, and losing one's email account means you lose practically your entire online identity (banks accounts, domain names, Google AdWords accounts, etc etc) even before OpenID explicitly makes your email king of all credentials.

Re: Coding Horror: Your Internet Driver's License

#15
post #10

I'm not sure he's talking about a separate "Internet ID" that should exist. I think he's talking about websites adopting OpenID and/or OAuth as authentication methods, with a smaller number of trusted entities as authorities (Facebook, Twitter, Google, MyOpenID, Verisign, etc). I'm not sure where people are getting this idea that he's talking about creating a new concept called an Internet Driver's License. He's just…

Oauth .. I just went to check it out, http://alicious.com/img/OAuth_1290599253386.png

Ironic.

Re: Coding Horror: Your Internet Driver's License

#16
post #14
post #5

Earlier quoted context omitted.

You can be fully in control of your own OpenID if you want. Just host it on your own domain/server. Or even easier: use delegation. Add some meta tags to the header of your blog (or any HTML page under your control), and sign up for sites using your blog URL as your OpenId. See an example at my domain (the content is currently blank, but the meta tags are in the source code): http://jmh.id.au I can sign up anywhere b…

I have multiple problems with this answer. The first is practical: you are not qualified to run OpenID on your server. Really, you're not. I'm not and I have actually implemented both OpenID providers and Relying Parties for clients before, at the old day job. If you run OpenID, you are exposed to every threat your OpenID provider is currently vulnerable to in perpetuity , unless you make it your mission in life to s…

I'm getting some cognitive dissonance here, since the grandparent says [I] use delegation and you say not to run your own server and to use delegation...

Anyway, is delegation going to get better, or should I not bother setting it up and just stick to using the same password for all my non-interesting sites? In particular, is it the site I delegate to, or the site I am authenticating myself to, or both, that can screw it up?

Re: Coding Horror: Your Internet Driver's License

#17
tl;dr: Jeff Atwood says websites should offer OpenID or OAuth authentication.

edit: ok, the sarcasm in this comment may justify it being downvoted, but can someone kindly explain what is being said in this article apart from: "having many logins/passwords for each site is not nice, we should all support OpenID/OAuth"? Because I really don't see any other piece of information.

Re: Coding Horror: Your Internet Driver's License

#18
post #2

I am not sanguine on the idea, but the marketing for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driv…

That, and the concept of the driver's license as the definitive ID document is quasi exclusively and strongly connoted as a funny US peculiarity.

Re: Coding Horror: Your Internet Driver's License

#20
post #9

Isn't one of the main benefits and best things about the internet is anonymity? Obviously FB and Twitter have information about my real identity, but why would Instapaper, or Reddit? Having a global login takes away that anonymity.

Anonymity (or pseudonymity) is fine, but it's not even in my top ten favourite things about the internet.
Post reply on HN