The OpenID specification gives a lot of flexibility to an individual when it comes to choosing an identity for authentication. In OpenID protocol, your username is simply your URL and you, as the user, control who is looking at your information and how.
One can use a URL they control for OpenID authentication. Also, if I have a a blog, I can use the blog address as my OpenID authentication URL with the use of LINK and META tags. There is a very good HOWTO here.
But which URL ? I think a lot of people will be struggling with that, sooner or later.
- People’s blog addresses can change. Most particularly so if you are using a free blogging service. What’ the guarantee that in about a year, my blog address is still kreaper.blogsome.com ? Then what happens to all of my accounts where I signed in as kreaper.blogsome.com ?
- If one is using a third party, free openid URLs (myopenid.com, videntity.org etc), then even that can change. What happens to those accounts ?
- In all of the above cases, my authentication is tied to my URL server’s uptime ? Not sure if I like that.
- If I have an i-name, I can setup a URL forwarder to my actual OpenID URL. However, even i-names can be transferred just like domains — if you let an i-name expire, then the next guy who gets my i-name gets my accounts ?
We know that i-names are actually a user-friendly names to i-numbers. I-Numbers are supposed to be permanant where as i-names are not. So if I am rest assured that my i-number can NEVER be re-assigned to another person, then should I be using my i-number as my openid URL ?
what is SPOF?
You do not need to set up a forward to authenticate an i-name with OpenID (in fact that would be a bad way to do it). OpenID 2.0 natively supports XRI resolution. When you enter your i-name XRI resolution is performed to find the YADIS document (instead of de-referencing the OpenID URL), once the YADIS document is retrieved authentication proceeds the same for an i-name as it would for a URL(more or less).
When you authenticate using your i-name what is persisted by the relying party is actually the i-number that the name resolves to. This gives 2 benefits:
1) If you have multiple i-names associated with the same i-number you can use any of them when you return to the relying party, you don’t have to remember ‘which i-name I used here last time’.
2) If you stop using an i-name and start using another one, assuming you put that new one on the same i-number, your experience at your service providers will be one of seamless continuation of service while the person who buys your ‘old’ i-name will instantly be recognized as a different person.
Hope this helps
You can always contact me at =andy if you want to chat more.