I just ran into a nice problem. I went over to Serverfault, where I don't go very often, so I was logged out. No problem, I'll just login. But MyOpenID is down right now, so it seems like I can't log in at all. When I try to login, I see the following message from Serverfault.
Unable to log in with your OpenID provider:
Web request to 'http://www.myopenid.com/xrds?username=kibbee.myopenid.com' failed.
I've logged in recently for Stack Overflow and Meta, so no problems there, but currently there's no way for me to log into Serverfault.
To me this points out a big downside of open ID. Assuming all web sites used OpenID, then, if your OpenID provider went down, you wouldn't be able to log into anything. What if your OpenID provider just went out of business. Would you lose you identity, and be unable to log into any sites, without creating a whole new identity?
Could we add a feature to Stackoverflow, so that we can authenticate possibly by providing the same OpenID url, and providing a password to Stackoverflow, in the event that the openID provider is unavailable?
Also, I'm using the delegate feature of OpenID, so my actual OpenID is a URL on my own website, and using the following code, I have delegated to MyOpenID.
<html> <head> <link rel="openid.server" href="http://www.myopenid.com/server"> <link rel="openid.delegate" href="http://xxxxxx.myopenid.com"> <meta http-equiv="X-XRDS-Location" content="http://www.myopenid.com/xrds?username=xxxxxx.myopenid.com"> </head> <body> </body> <html>
So, as far as the Stackoverflow system goes, is my OpenID url the one I type in, or the one I get delegated to? Sorry for so many questions, but this whole "all-your-eggs-in-one-basket" thing is why I think something like your online identity shouldn't be put into the hands of some other website, which is why I created an OpenID url at my own website.