FUDCon report from the Fedora Project Leader (Red Hat Magazine)

“This means that the identity you create in the Fedora Project can be used across thousands of
web sites.”

... but the identity you already have cannot be used at the Fedora Project.

Setting up an OpenID _provider_ like this is very nearly useless. Fedora ought to be looking
at becoming an OpenID relying party, not a provider.

Let me provide an analogy. Being an OpenID provider is like setting up a credit card company.
Maybe you want to do that, if you're a big financial organisation and you have all the
know-how to do a good job of it, and you feel that you can offer something better (low
interest rate, convenient payment, etc.) than competitors. But if you don't have the expertise
then you're producing Monopoly money, everyone will stick with their VISA.

But if you want to reduce how many different credit cards people carry, you don't want to set
up a credit card company, you want to start accepting the most common existing credit cards.
Offering your own brand of card is actually counter-productive, that's just another card
everyone has to carry.

Adding relying party support to Fedora's site and services would be much harder, but it
wouldn't be an empty gesture like this, it would be a real achievement. There would be solid
benefits for Fedora and its users. Worried about "break-ins" ? No-one can steal your user's
passwords, because you don't have them, you don't even have a password hash, you just know
their OpenID which is public. Concerned about integration? The use of URIs in OpenID makes it
child's play to join two arbitrary account systems together, and if they need to be separated
again later you can safely do that too. No more "all passwords will need to be changed, sorry"
emails or "please note that now the password from site A is used on site B".