Slides from my keynote at PyCon UK 2007.

1. Building the
Social Web with
Simon Willison
PyCon UK, 8th September 2007

2. Who here has used
OpenID?

3. Who uses it regularly?

4. Four problems
• Usernames and passwords suck
• Signing up for new accounts is a pain
• My online identity exists in dozens of
different places
• Social software suffers from too much
overhead

5. Four problems
(and their OpenID related solutions)
• Usernames and passwords suck
• Signing up for new accounts is a pain
• My online identity exists in dozens of
different places
• Social software suffers from too much
overhead

6. Usernames and
passwords suck

8. “We want to make you aware that media of ours
that contained a backup of a portion of the reddit
database was stolen recently [...] we wanted to
alert you to the possibility that your username,
password, and -- in some cases -- e-mail address
may have been compromised.
”
Steve Huffman, reddit.com

9. Two lessons
• Don’t store plaintext passwords in
your application’s database
• Don’t use the same password
on more than one site!

11. The Web needs
Single Sign On

12. ?

13. SSO with a single
controlling authority
betrays the principles
of the Web

14. OpenID is a
decentralised mechanism
for Single Sign On

15. An OpenID is a URL

16. http://swillison.livejournal.com/

17. http://simonw.myopenid.com/

18. http://simonwillison.net/

19. http://openid.aol.com/simonwillison/

20. The OpenID protocol
lets you prove that you
own a specific URL

21. An OpenID can be used as
an authentication credential

22. “Who the heck are you?!”

23. “I’m simonwillison.net”

24. “prove it!”

25. (magic happens)

26. “OK, you’re in!”

27. Picking an OpenID is
like picking an e-mail
provider - you find one
that you trust

28. If you have the ability to
run your own server
software, you can do it
for yourself

29. http://siege.org/projects/phpMyID/

30. So how do I use it?

35. So my users don’t
have to sign up for an
account?

36. Not necessarily

37. An OpenID tells you
very little about a user

38. You don’t know
their name

39. You don’t know
their e-mail address

40. You don’t know
if they’re a person
or an evil robot

41. Where do I get that
information from?

42. You ask them!

43. OpenID can help them answer

46. So how does OpenID
actually work?

49. <link rel=quot;openid.serverquot;
href=quot;http://www.myopenid.com/serverquot; />

50. “I’m simonwillison.myopenid.com”

51. Site fetches HTML,
discovers identity provider

52. Establishes shared secret
with identity provider
(Using Diffie-Hellman key exchange)

53. Redirects you to the
identity provider

54. If you’re logged in there,
you get redirected back

55. How does my identity
provider know who I am?

56. OpenID deliberately
doesn’t specify

57. username/password
is common

58. But providers can
use other methods if
they want to

59. Client SSL certificates

60. Out of band
authentication via SMS,
e-mail or Jabber

61. SecurID keyfobs

62. No authentication at all
(just say “Yes”)

63. Just say “yes”?

64. Yup. That’s the OpenID
version of bugmenot.com

65. http://www.jkg.in/openid/

66. Users can give away
their passwords today -
this is just the OpenID
equivalent

67. What if I decide I
hate my provider?

68. Use your own
domain name

69. Delegate to a
provider you trust

72. <link rel=quot;openid.serverquot;
href=quot;http://www.livejournal.com/openid/server.bmlquot;>
<link rel=quot;openid.delegatequot;
href=quot;http://swillison.livejournal.com/quot;>

73. Support for delegation
is compulsory

74. This minimises lock in

75. So everyone will end up
with one OpenID that
they use for everything?

76. Probably not

77. (I have half a dozen
OpenIDs already)

78. People like maintaining
multiple online personas

79. professional
social
secret
...

80. OpenID makes it easier
to manage multiple
online personas

81. Three accounts is still
better than three dozen

82. If an OpenID is a URL, is
there anything else interesting
you can do with it?

83. Yes. Different OpenIDs can
express different things

84. My AOL OpenID proves
my AIM screen name

85. An OpenID from
sun.com proves that
someone is a current
Sun employee

86. A last.fm OpenID
could incorporate
my taste in music

87. My LiveJournal OpenID
tells you where to find
my blog

88. OpenID and web
service APIs naturally
complement each other

89. What about phishing?

90. Phishing is a problem

91. I can has lolcats!? BETA
Make your own lolcats! lol
Sign in with your OpenID:
OpenID: Sign in
http://icanhascheezburger.com/2007/05/16/i-has-a-backpack/

92. Fake edition
Your identity provider
Username and password, please!
Username:
Password:
Log in

93. Identity theft :(

94. An untrusted site
redirects you to your
trusted provider

95. Sound familiar?

96. PayPal
Yahoo! BBAuth
Google Auth
Google Checkout

97. One solution: don’t let
the user log in on the
identity provider
“landing page”

99. Better solutions

100. CardSpace

101. Native browser
support for OpenID
(Firefox 3, Seatbelt)

103. Competition between
providers

104. Doesn’t this outsource the
security of my users to
untrusted third parties?

105. Yes it does. But...

106. ... so do “forgotten
password” e-mails!

107. If e-mail is secure
enough for your user’s
authentication, so is
OpenID

108. Password e-mails are
just SSO with an
unavoidably bad user
experience

109. Best practices for
OpenID consumers?

111. “I forgot my password”
becomes “I can’t sign in
with my OpenID”

112. Allow multiple OpenIDs
to be associated with a
single account

113. People can still sign
in if one of their
providers is down

114. People can un-associate
an OpenID without
locking themselves out

115. You can take advantage
of site-specific services
around each of their
OpenIDs

116. What are the privacy
implications?

117. Cross correlation of
accounts

118. Don’t publish a user’s
OpenID without making
it clear that you’re going
to do that

119. Allow users to opt-out
of sharing their OpenID

120. Any other neat tricks?

121. My online identity exists in
dozens of different places

123. I can use OpenID to tie
these profiles together

124. Portable contact lists

125. Facebook (and others)
currently ask for the
user’s webmail username
and password

126. Lightweight accounts

127. Pre-approved accounts

128. Social whitelists

129. OpenID and
microformats

130. Identity projection

131. Decentralised social
networks

132. “People keep asking me to join
the LinkedIn network, but I’m
already part of a network, it’s
called the Internet.”
Gary McGraw, via Jon Udell, via Gavin Bell

133. An open alternative?

134. Who else is involved?

135. 0
875
1,750
2,625
3,500
Se
p
'05
O
ct
N
ov
D
ec
Jan
'06
Fe
b
M
ar
Ap
r
M
ay
Ju
ne
Ju
ly
Au
g
Se
p
O
ct
N
ov
D
ec
Jan
'07
Fe
b
Total Relying Parties
M
ar
Ap
r
M
ay
Ju
ne

137. How do I build it in to my
Python application?

138. Open Source libraries
from JanRain

143. OpenID
Smart hackers needed

144. http://openid.net/
http://www.openidenabled.com/
http://simonwillison.net/tags/openid/

145. Thank you

146. Questions?