I was recently
asked about openID's after one user had thought that it was not secure and quite frankly seemed pointless.
I also thought the same when I first seen openID support on my blogger comments. I figured if I could just write in any url then I could be anyone. I wanted to how is that secure?
Well ladies and gentleman,
openID is a little bit of a magician and works in mysterous ways.
(Here is my reply to the above blog entry)
The way open ID works is, say you comment on a blogger blog with your wordpress URL, the first instant you submit your comment, openID checks your computers cookies to see if you are already logged on to wordpress with that URL username. If you are logged on under the correct URL/username then your comment gets posted. If you are not logged on to wordpress then your comment is rejected.
The simpliest way to try this out is to log out of wordpress, find a blogger blog to comment on - say this one. Submit your comment and your wordpress URL. What will happen is openID will check your cookies, and if you remembered to log out of your wordpress account, you will be asked to log in to wordpress first.
So unless you know the password to the url you submit you cannot post under that url.
Which is great now, as all those people with wordpress blogs but blogger accounts to post comments on blogger friends, no longer need to worry about logging in to blogger. Just carry on using your wordpress openID.
You could also try it out by submitting a comment under a url that doesnt belong to you, say a friends. OpenID will see you are not logged on under that username and reject your comment.
Cool eh! And safe.
The reason you may not have noticed anything at present will be because you have “keep me signed on all times” ticked on your blog.
So unless someone can log on to your account with your own password they cannot post under your url. Very secure and no way of fake posters.
So now anyone who comments with openID I will know is genuine.
The power of cookies. It all seems fancy and magical.
Now I want a cookie.
Visit
http://openid.net/ for more info, which sites already support openID (you might already have an openID) or how to get one.