Subversion Repositories website

[/] [about.bml] - Rev 74

Go to most recent revision | Compare with Previous | Blame | View Log

<?page
wintitle=>About OpenID
body<=

<h2>How's it work?</h2>

<p>Here's the big picture:  (for details see <a href="specs.bml">the specs</a> or the <a href='pres/protocolflow-1.1.png'>authentication protocol flow diagram</a>)</p>


<ul class='spaced'>
<li>You maintain a blog at, say, <b>livejournal.com</b> (but this can be anything) and you stay logged in there usually.</li>

<li>You go to leave a comment at <b>someblog.com</b> (perhaps it's Movable Type, or Wordpress, or DeadJournal, ...) and you don't have an account there, so there's otherwise no way to leave an authenticated comment.  But if their blog-system has OpenID support, you see something like:  (but hopefully prettier)
<div style='margin: 1em 0 1em 2em; border-left: 2px solid black; padding-left: 1em;'>
<form onsubmit='return false;' action='get'>
<b>Login with your blog URL:</b> <input class='sexy' size='30' value="" /> <input type='button' value='Login' /><br />
<i>For example: <tt>happygirl.bloghost.com</tt></i>
</form>
</div>
</li>

<li>You type "brad.livejournal.com", click login, and then without leaving the page and destroying the comment you were working on typing, the someblog.com server does some work:
   <ul>
      <li>Looks at your blog, and finds your OpenID server.  You don't even know what OpenID is, but your publishing software did it all for you.</li>
      <li>The someblog.com server returns to your browser and tells it the OpenID identity server it found.</li>
   </ul>

</li>


<li>Then your browser contacts the identity server (see <a href="specs.bml">the details</a>) and one of two things happen....

    <ol>
     <li>If you've never told your homesite (LiveJournal in this case) that you trust this someblog.com site to know your identity, your homesite tells the page that (without revealing who you are) and the UI changes to something like this:  (the UI is left entirely to the sites wanting to confirm an OpenID identity)

<div style='margin: 1em 0 1em 2em; border-left: 2px solid black; padding-left: 1em;'>
<form onsubmit='return false;' action='get'>
<b>Login with your blog URL:</b> <input class='sexy' size='30' value="brad.livejournal.com" /> <input type='button' value='Login' /><br />
<b><span style='color: red'>Note:</span></b> You need to login to livejournal and/or mark this site as trusted for authentication to continue.  Your homesite, LiveJournal, says you can do that <a href="http://www.livejournal.com/login-and-or-setup-permissions" target='_blank'>here</a> [opens new window], then you can login again.
</form>
</div>
    </li>

     <li>Once you've told your homesite (your identity server, LiveJournal) that you trust this site you're visiting, everybody communicates behind the scenes to validate your identity, and you see perhaps:
<div style='margin: 1em 0 1em 2em; border-left: 2px solid black; padding-left: 1em;'>
<b>Hello, Brad!</b>  You're now logged in to someblog.com as <u>Brad from LiveJournal</u>.
</div>
     </li>
    </ol>
</li>

<li>Then you finish your comment, submit it, and the someblog.com server validates your identity behind the scenes, doing some mild crypto stuff explained <a href="specs.bml">in specs</a>.  If someblog.com is playing by the rules, nobody else can fake your identity.  Of course any site can lie, but what fun is a thousand people all saying they're Bill Gates, and message boards allowing it?  So respectable sites (where you'd hang out) would play by the rules.</li>

</ul>

<h2>What about trust?</h2>

<p>This is <b>not</b> a trust system.  Trust requires identity first.</p>

<h2>What about spam?</h2>

<p>Again, this is not a trust system.</p>

<p>Somebody could run their own identity server that says they're http://spammer.example.com/000001/ all the way to http://spammer.example.com/999999/ and that's not a goal of this system to prevent.  It's another layer's job to say the identities with URL spammer.example.com/* is a spammer, or some ID server is a known spammer, or some particular identity is a known spammer.</p>

<p>What this does prevent is anybody but that spammer from using that identity URL.  While somebody else could make their ID server say that they're that http://spammer.example.com/000001/ URL, <i>a)</i> why would they?, and <i>b)</i> unless they also controlled the host spammer.example.com, they couldn't change the &lt;link rel=..&gt; tag to point to their rogue identity server.</p>

<h2>What about signing comments?</h2>

<p>This system doesn't sign comments.  If a rogue site says it's OpenID-enabled but actually isn't and claims to have posts from your identity, that doesn't mean anything.  This system isn't designed to prevent that.  The goal of this is for sites that do care about preventing spoofed comments/identities to be able to do so, if they play along.</p>

<p>After all, anybody could put up a geocities page right now that says anybody said anything.  Do you trust it just because you read it?</p>

<p>There are, however, some pretty obvious spots to insert comment signing into this scheme, so it's likely a future version of this spec will include that, with the identity server providing back a permalink/signature to the comment posted, so readers on some random site can go back to the origin to verify it.</p>

<=body
page?>

Go to most recent revision | Compare with Previous | Blame