OpenID is an untrusted protocol. Sun has no liability for what happens to any information you give to a third-party web site using this service. Most OpenID-enabled sites are genuine but some may be phishers or other rogues. Sun currently has no way of distinguishing the good sites from the bad. Do not use the OpenID@Work service for any high-value, critical, or Sun proprietary information.
Link: OpenID at work - Sun
Really?, so this sux!.
Hey,
That franzon must be a relatively intelligent person!! Especially for disliking Sun.
That franzon must be a relatively intelligent person!! Especially for disliking Sun.
I do question this article, though. It is making this sound like a late-breaking update to a security flaw, which it isn't. If franzon decided to read up a bit more on this, he might have found the FAQ section.
OpenID was designed to let you authenticate, but what you're really doing is proving that you own the rights to use a particular URL for a period of time. In this case, your OpenID identity, http://openid.sun.com/username. Any consumer site can accept or reject a login based on that identity, we have no influence over that, or over anything they do with your information once you've logged in to that site. They may be phishers trying to steal credit card information, or they may be a perfectly respectable site doing a good job of keeping your information private. We just don't know. We haven't signed contracts with any consumer site, and hence in a legal sense we can't trust them. This means you have to use your own instincts in deciding whether to give any site you log into with your Sun OpenID any information, or whether to log in there at all.
You should be able to lock down your own content and restrict access to your sites without being affected by what others do. I really don't know why Sun is avoiding this unless they are depending on obscurity for security. TCP/IP packets can be passed through untrusted sources and still be uncompromised if the proper measures are taken. You'd think Sun would have experience here...
Like for example, if my OpenID is my LJ account, I can go on someone's myspace, leave a comment that links to my OpenID LJ account and that person will know it's me, even though I don't have a myspace account. That's it's purpose and you can run your OWN OpenID service if you really want to.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.