OpenID is an third-party identification protocol that allows users to log on to multiple websites with only one username and password. Users register with one OpenID website, called an Identity Provider. The user can then log on to any website that accepts OpenID using the identity from the provider. The “OpenID Acceptor,” as it is called, will send a request to the Identity Provider, which in turn authenticates the username and password and provides a certificate to the OpenID Acceptor. This certificate, it is important to note, includes varying amounts of personal information, such as email or home addresses, phone numbers, or geographic locations. Often, OpenID providers afford the user broad control over which personal information is shared with any given OpenID Acceptor.
Many social media sites themselves are becoming OpenID emulators. Facebook’s version, called Facebook Connect, allows users to log in to sites like Vimeo, JibJab, and CNET without the user having to set up local accounts on those sites. Not all Identity Providers offer the same features; some disseminate far more personal information than others. Many prompt the user for manual selection of certain personal records, while others simply rely on the Acceptor to take only what is actually needed. Companies employing third-party identification protocols may wish to review the supported features of each Identity Provider and the Identity Providers terms and conditions and privacy policy.
