Just about the time I was ready to call OpenID a total failure, something clicked and, if you asked how I thought "OpenID was doing," I'd have to say that it's largely a success. But it certianly took long enough to get here.

Lets back up and give some context.

OpenID is a system for distributing and delegating authentication for web services to third party sites. Basically to the end user, rather than signing into a website with your username and password, you sign in with your profile URL on some secondary site that you actually log into. The site you're trying to log in, asks the secondary site "is this legit," the secondary site prompts you (usually just the first time, though each OpenID provider may function differently here.) then you're good to go.

Additionally, and this is the part that I really like about Open ID is that you can delegate the OpenID of a given page to a secondary host. So on tychoish.com you'll find the following tags in the header of the document:

<link rel="openid.server" href="http://www.livejournal.com/openid/server.bml" />
<link rel="openid.delegate" href="http://tychoish.livejournal.com/" />

So I tell a third party site "I wanna sign in with http://tychoish.com/ as my OpenID," it goes and sees that I've delegated tychoish.com's OpenID to LiveJournal (incidentally the initiators of OpenID if memory serves,) and LiveJournal handles the authentication and validation for me. If at some point I decide that LiveJournal isn't doing what I need it to, I can change these tags to a new provider, and all the third party sites go talk to the new provider as if nothing happened. And it's secure because I control tychoish.com and contain a provider-independent identity server, while still making use of these third party servers. Win.

The thing is that OpenID never really caught on. Though managing a single set of authentication credentials, and a common identity across a number of sites has a lot of benefits to the users, it never really caught on. Or I should say, it took a very long time to be taken seriously. There are a number of reasons for this, in my understanding:

1. Third party vendors wanted to keep big user databases with email addresses. OpenID means, depending on implementation that you can bypass the traditional sign up method. This isn't a technological requirement but can be confusing in some instances. By giving up the "traditional" value associated with sponsoring account creation, OpenID seemed like a threat to traditional web businesses. There were ways around this, but it's confusing and as is often the case a dated business model trumped an inspiring business model.

2. There was and is some fud around security. People thought if they weren't responsible for the authentication process that they wouldn't be able to ensure that only the people who were supposed to were able to get into a given account. Particularly since the only identifying information associated with an account was a publicly accessible URL. Nevertheless it works, and I think people used these details to make people feel like the system isn't/wasn't secure.

3. There are some legitimate technological concerns that need to be sorted out. Particularly around account creation. This is the main confusion cited above. If someone signs up for an account with an OpenID, do they get a username and have to enter that, or do we just use the OpenID URL? Is there an email address or password associated with the account? What if they get locked out and need to get into the account but there's no email? What if they need to change their OpenID provider/location at some point. These are legitimate concerns, but they're solvable problems.

4. Some users have had a hard time groking it. Because it breaks with the conventional usage model, and it makes signing into sites simple it's a bit hard to grok.

What's fascinating about this is that eventually it did succeed. More even than joy at the fact that I get to use OpenID, finally, I think OpenID presents an interesting lesson in the eventual success of emergent technological phenomena. Google accounts, flickr accounts, and AIM accounts all provide OpenID. And although "facebook connect" is not using OpenID technology, it's conceptually the same. Sites like StackOverflow have OpenID only authentication, and it's becoming more popular.

OpenID succeeded not because the campaign to teach everyone that federated identity vis a vis OpenID was the future and the way we should interact with web services, but rather because the developers of web applications learned that this was the easier and more effective way to do things. And, I suspect in as much as 80% or 90% of cases when people use OpenID they don't have a clue that that's the technology they're using. And that's probably an ok thing.

The question that lingers in my mind as I end this post is: is this parallel any other optimistic technology that we're interested in right now? Might some other "Open*" technology take away a strategic lesson from the tactical success of OpenID? I'd love to see that.

Onward and Upward!