This question is mainly aimed at OpenID Connect, when it is fully realized. I un

Question

This question is mainly aimed at OpenID Connect, when it is fully realized.

I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed to finally allow developers to simply implement OIDC once and have it work with every provider.

Once this happens and people have the option to sign in with a non-social-network, and see the options like Symantec and realize that 'oh, this Identity thing isn't just about sharing my email contacts and friends list with the entire planet', I believe that much of the distrust will evaporate.

So ignoring the hesitation to oauth with a social network, and moving onto the question:

Is BYOID as the only way to authenticate, and thus completely outsourcing authentication, a valid security practice?

Explanation / Answer

Yes this is a reasonable approach.

It is not a zero risk approach. If a user does not already have an OpenID Connect account, or they do not understand the concept, the sign up process becomes more difficult and you risk losing that user. Because you are doing something that is non-standard you will get some smart alec users who pester your support guys with pedantic complaints. And if there is some future compromise, perhaps a flaw in the OpenID Connect protocol, you may look foolish compared to the sites that never pursued this approach.

But on balance I believe this is a good thing to do. Most users will already have an account with one of the major provides and will be happy to use that, just as I happily use my Google account to log in to stack exchange. A smaller number of users will have an account with a minor provider, who they've chosen because they like their privacy policy. And some will even run their own OpenID Connect server. I believe this covers everyone's needs, so there is no need to provide a fallback to user name + password authentication.

Related Questions

Navigate

• Browse (All)
• Browse T
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.