Updated: Never — Philip's Blog

More and more websites seem to be showing that funny OpenId logo and more and more people I know appear to be quite lyrical about the stuff.

Still. I'm a skeptical bastard. I wonder if OpenID is not a solution looking for a problem, like so many "Web 2.0" technologies.

Using the same username and password everywhere would of course be unbelievably stupid. If one site is broken (or run by a sneaky and enterprising individual), your identity is effectively owned.

I am still using the good old paranoid method of dealing with the plethora of websites that want me to create "accounts" and would like me to create a username and a password to log in to them.

Ever since the beginning of time, I've been generating different passwords for the sites that want them, and storing them in a file on an encrypted volume. Over time, of course, that list has become rather long:

% grep http /cryptostick/keys/passwords.txt | wc -l
207

Many of the sites in that file, I've probably not visited in the last many years, some of them probably don't exist anymore. Not a problem, the amount of data I'm storing about them is probably on the same order of what I once told them about me: very little.

So back to OpenID: if I understand it correctly, it would replace this simple plain text file I keep on an encrypted volume with a whole infrastructure of XML-communicating "things", any of which could possibly break, any of which would be - like anything XML - hideously difficult to debug and, most importantly, like any "web technology", unbelievably volatile and subject to becoming obsolete at the drop of a hat.

I can think of any number of other things that can and will go wrong.

It's a "web technology". People rely on PHP and other security holes, and we all know what happens to infrastructure built on a foundation of wet tissues. After a couple of months, some bright spark comes up with "2.0", also built on wet tissues but now they're "layered". Or something. Try to follow the metaphor.

In any case: either your identity is completely and utterly up for grabs, or you've invested a lot of time (and possibly money) in a very complicated (though probably very pretty) infrastructure which is now completely obsolete.

At the same time, my trusty text file on its encrypted volume (with its backup on dead tree stored somewhere physically secure) celebrates its tenth birthday and still works as well as the day it started as an empty file.

I'll stick to "Web 0.9", thank you. I don't think I could handle the stressful life of "developing for the web". It's so much more relaxing in the kernel, where standards develop at glacial speeds. bliss.