OpenID Migration

Question

I'm curious about OpenID. While I agree that the idea of unified credentials is great, I have a few reservations. What is to prevent an OpenID provider from going crazy and holding the OpenID accounts they have hostage until you pay $n? If I decide I don't like the provider I'm with this there a way to migrate to a different provider with out losing all my information at various sites?

Edit: I feel like my question is being misunderstood. It has been said that I can simple create a delegation and this is partially true. I can do this if I haven't already created an account at, for example, SO. If I decide to set up my own OpenID provider at some point, there is no way that I can see to move and keep my account information. That is the sort of think I was wondering about.

Second Edit: I see that there is a uservoice about adding this to SO. http://stackoverflow.uservoice.com/pages/general/suggestions/16685

Answer 1

This may help: OpenID

Answer 2

What is the guarantee of these things not happening with any other site or provider? You have to trust certain organizations every once in a while. Otherwise you better bury your money in a mason jar in the backyard.

Answer 3

Nothing prevents the provider from holding your account to ransom. You should pick a provider that you know to be reliable. Or, if you trust nobody but yourself, you can be your own provider:

http://wiki.openid.net/Run_your_own_identity_server

Answer 4

This is why you can use OpenID delegation, i.e. you set up two META tags on your personal website and then you can use that site's URL as an alias for your current OpenID provider of choice. Should it get unfriendly you just switch to another and update your tags.

Additionally you can always operate your own OpenID identity provider (if you have a server with, for example, a web server and PHP on it). I use phpMyID for this.

Update: regarding the updated question: OpenID consumers (sites where you log in using OpenID) may allow you to switch the OpenID used for sign-on at their discretion. Sourceforge, for example, does. To prevent problems it's best to use delegation right from the start. Otherwise this is a necessary limitation imposed by OpenID's design.

Answer 5

I think you might be mixing free-market providers with governments. Latter abuse their power because you got nobody else to go to (try to get an "alternative" passport). Since the OpenID prividers have competition, you can always leave one provider and go to another.

Answer 6

A site that implements OpenID authentication in a good way would allow you to switch your ID to another URL or to specify a secondary ID in cases when your primary provider happens to be down.

Currently, most sites still don't have this option, and yes -- if our OpenID providers would delete our accounts one day, we'd have trouble getting to our accounts on some sites. We trust them in not denying us the service.

Answer 7

There's no way to stop Google from holding my gmail inbox hostage until I pay them $n. It's a trust thing, I guess.

Answer 8

It's an OpenID relying party best practice to allow multiple OpenIDs to be associated with a single account.

It's also an OpenID relying party best practice to allow people to recover their accounts without access to their old OpenID.

If Stack Overflow doesn't do these things, then this is a shortcoming of Stack Overflow, not OpenID.