The problem(s) with OpenID

Posted May 28, 2008 12:15 UTC (Wed) by martinfick (subscriber, #4455) [Link]

They're not.

Actually, they are, I brought HA up on the list last year, and few people thought that it was important.

With OpenID 2.0 you can specify your identity provider using XRDS, which uses a mechanism more or less exactly like MX records to specify multiple servers.

As mentioned in my previous post, this simply moves the single point of failure to a web server somewhere (if you think it doesn't please explain). This is hardly a reliable replacement for MX records which live in DNS servers which can easily be replicated many places.

Posted May 28, 2008 12:09 UTC (Wed) by martinfick (subscriber, #4455) [Link]

Please forgive my ignorance on this one, I understand DNS SRV records, but how does jabber
interact with this since (unlike email) it requires a session?   If at connection time my
jabber client connects to  xmpp-server4.l.google.com and later this server goes down, will my
connection be maintained by xmpp-server.l.google.com?  Probably not right?  So I guess a
manual fail over is required at this point (I simply need to relogin to the next available
server), which should actually be fine since an automated solution does not seem required for
this.

I admit that perhaps I have not been clear enough about what I consider a valid HA solution
for an individual, but the above will probably not be sufficient, let me explain why.
Remember, as an individual, HA for an SSO solution is probably more important than for any
other protocol!  If my email goes down for an hour, big deal, if my SSO goes down for an hour
this will affect me much more!  But yet, my email solution (which is less important to make HA
than SSO) has a simple backup method that I can easily delegate to someone else, does jabber?

So a valid SSO HA solution for an individual would require that it be easy to failover to an
offsite solution that someone else can handle for me.  MX records allow me to do this for
email, I can simply point my MX records to my friend's (or my ISP's) mail server and they can
accept mail for me when my server goes down.  Throwing expensive hardware at the solution at
my site will still not be as reliable as simply having a friend provide backup MX service for
me.  

Can a friend easily provide a backup XMPP service for you?  How would the naming scheme work?
If my jabber account is  JohnDoe@mydomain.com, how can my friend (or ISP) use his jabber server
which hosts Friend@backup.com to backup my JohnDoe@mydomain.com account?  If you solve this,
than I think that you may have a solution that is a valid replacement for both the current
schemes of username/passwords backed up by an email "reset" feature.

Posted May 28, 2008 13:35 UTC (Wed) by martinfick (subscriber, #4455) [Link]

Given that people have been deploying HA solutions for the technologies OpenID is based on for a long time, why do you say that OpenID doesn't help with HA?

Actually, most of the solutions that you mention are either performance/scaling solutions or expensive workaround HA solutions because the protocols that you mention do not have HA built into them to start with! So openid DOES NOT help with HA, it simply assumes that the technologies that you mention will be enough to provide it. I am claiming that they will not! These solutions will not provide a solution for an individual who wants to setup his own openid server and wants to simply delegate failover to a friend or an ISP.

To be more specific:

* The discovery phase of OpenID is basically just a few plain HTTP requests. It should be no more difficult to add redundancy here than for any other web site (round robin DNS, load balancers, etc).

These are mostly performance, not HA solutions. None of these allow for simple delegation (if so, please explain how).

* The preferred discovery mechanism for OpenID 2.0 is to serve and XRDS document, which includes a priority list of service endpoints. The RP will pick the highest priority service with a supported protocol. This provides a way to specify that multiple OpenID providers can make assertions about a single URL, and provides an entry point for doing round-robin provider selection.

Again, this does not allow for the XRDS document to be simply delegated to someone else (if so, please explain how). If this were backed by a simple naming scheme that allowed me to delegate this to someone else it would be fine. But, as is, without this feature you have just moved the single point of failure to the XRDS document and whatever expensive hardware you can throw at this document to keep it up. When the dust settles, by using XRDS you have just introduced another link that can break instead of adding another chain in parallel, this actually makes things worse from an HA perspective!

I believe that your remaining three bullets are actually unnecessary. Users can (at least I can) live with a momentary interruption of service while failover occurs, but obviously this cannot persist.

So it looks like you can introduce HA to pretty much any part of the protocol.

You make it sound like I only have to introduce it to one part when I really have to introduce it to every part for it to actually be HA. And as shown above, many of those parts will not be easy to introduce it to without help from the protocol.

As for the independence issue, things seem similar to email. Maintaining your independence while setting up an HA mail system will involve setting up redundant servers. You can delegate some of this to other organizations as backup MX...

But how can I delegate this to others with openid? The protocol does not provide a mechanism to do this? Can a friend easily provide a backup openid service for you? How would the naming scheme work? If my identity URL is http://mydomain.com/myopenidsoftware/John.Doe, how can my friend's openid server which gives him an identity URL of http://backup.com/backupopenidsoftware/Friend use his server to backup my id? That is the problem, there is no easy standard way of doing this?

If there were a standard way to create openid identity URLs, this might be possible. I have suggested a very naive solution to the openid mailing list, but few seemed to even think it was required, and none bothered to even rip apart my naive solution. :) They probably agree with you that HA can be thrown below the openid technologies, but this is really not feasible for the individual and I would think that it would not be feasible for most small businesses either. It's just an expensive kludge.

My naive solution is here: http://www.theficks.name/Hacks/OpenID, it is lame, but perhaps it could inspire someone to suggest a real solution, or to realize that openid needs one! I just realize now that perhaps a similar simple scheme could be used to make the XRDS document HA? I am not sure what would be better, but if XRDS doesn't really provide HA, why bother with its complexity anyway?

Posted May 28, 2008 10:53 UTC (Wed) by khim (subscriber, #9252) [Link]

If email authentication is used to reset my password, then access to my email is equivalent to access to my password.

If you can only reset the password then you can not use email as password replacement. You can not return password back to original state thus any such access will be visible for original owner. It's enough for many things.

This is why I hate systems that require me to give them an answer to some simple question "in case I forget my password," since that answer ends up being a weak password-equivalent.

You can always fix the system by entering word from /dev/random there. On the other hand lack of such a system will be a disaster for "normal" people who are not accustomed to world of IT where it is possible to create virtually unbreakable lock. They expect that police can always open the door if needed...

Posted May 28, 2008 10:57 UTC (Wed) by martinfick (subscriber, #4455) [Link]

I was not referring to the security mechanism of using email for authentication, your
comparison there is correct email is similar.  But I was talking about the HA part for which
email authentication is not equivalent!  If you temporarily lose access to your email you are
still able to login to your accounts without it, you simply have lost the ability to "reset"
your accounts.  With openid if you temporarily lose access to your openid server, you are SOL.
This really is different.