[Rails] [ANN] Ruby OpenID library and OpenIDLoginGenerator

Steve Sloan
Thu, 05 Jan 2006 21:00:31 -0000

Brian Ellin wrote:
> Read more and download the library:
> http://www.openidenabled.com/openid/libraries/ruby/
> http://raa.ruby-lang.org/project/openid/

That''s very cool, and similar to a single-sign-on schema I was
contemplating.
   This might just let me do away with user authentication all together, or at
least move it to my own identity server.  Anybody work on a Rails identity
server? :)

Before I take the plunge, though, I''m wondering how useful OpenID would
be for
preventing phishing attacks.  I know that the point is to identify the end
user to a third-party website, but what provision does the protocol offer to
the identity server for verifying that the website is who it claims to be (or,
at least, who it claimed to be when you first logged in to it).

In other words, if I tell my identity server to always trust foobar.com, what
assurance do I have that I''m actually being authenticated by
foobar.com?  Are
there persistent shared secrets between the website and the identity server?
And, as a website operator, what happens if those secrets are lost?

Thanks for code, keep up the good work.

-- Steve