I think you'll see more OpenID support than Passport and Lib
Alliance. Check http://openiddirectory.com/ for some of the sites and
providers. Also, check out Verisign labs (http://pip.verisignlabs.com).
Let's hope so since there was no widespread adoption of the prior ones.
A nice, easy, multi-factor solution for using OpenID is to use the
Verisign provider and a Paypal security key. When you login to an
OpenId enabled site, you'll go to the Verisign site and have to login
with the security key.
Sounds fine, but who's really going to adopt the key so it's more
meaningful than for paypal/ebay users, few of whom really care whether
there's a key or not to sell their collectible cards or other used trinkets.
An argument for OpenID with clients is that they are not responsible
for authentication, Verisign or an authorized provider is now
responsible for authentication. And the 2 factor authentication now
can be used at my clients website for a $5 paypal key.
I see that this would be useful to me as a web site that would like to
have such authentication for "free," but why would Verisign/Payapl want
to do such authentication for others for free? Can they sell
advertising for an authentication check, or will they attempt to charge
using companies in the future for such checks? It may even lead to
litigation, despite contract terms, that suggest if they "vouch" for the
authentication that they'll somehow be blamed for the scam.
And it seems that scammers will just use phishing sites to collect this
info, and then use the same two factors to try to scam the real web site
-- as long as they do it within 30 seconds, a time that's reasonable for
any electronic scam (there's no need to pause).
I've not heard of anybody actually using the $5 paypal key. It's not
to say nobody does, just the original question was about any uptake
we've seen, and I simply replied that we've not see any, nor have any of
our customers/users requested it (yet).
David
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------
