UPDATE: O'Reilly now points over to the post from AOL's John Panzer about this with more details. It's funny... I read that post yesterday from John, but I don't think the enormity of it sank in until about 5am this morning when I read the post from Fred Stutzman that I reference below.
Wow! Talk about a major boost for OpenID... continuing my OpenID research, I learned from reading Fred Stutzman (also here) that all 63 million users of AOL Instant Messenger can now use their AIM account for OpenID! Now, I don't actually use my AIM account all that much these days (my IMs of preference are Skype, Jabber and MSN/WLM)[1], but I had to try it out, so I headed over to stickis.com and logged in using my AIM screen name - as shown in the image to the right. Simple. Easy.
Okay, that's fairly cool. My OpenID is simply:
http://openid.aol.com/dyorkottawa
Now the only peculiar thing was that I never saw this screen to grant or deny the access to the site. The only reason I have this screen capture is because I pressed the Back arrow on my browser because I wanted a screen capture of the login page. In actual operation, once I was logged into the AOL OpenID page I went directly to the stickis.com page... without actually granting the site access to my OpenID.
Hmmmmmmm...
This happened in Firefox 2, so just to verify the issue, I flipped over to IE7 and tried the same procedure. Again, I was asked for my AIM password and then... bang... I was logged into the site (without seeing the Grant/Deny screen). Note that I am not running any AIM client on this PC right now.
Now at the second site I tried this at, schtuff.com (a wiki provider that allows OpenId login), I was prompted to Grant/Deny access... but I was apparently already logged in to AOL's OpenID server. Of course, I can't figure out how to log out of the AOL "Screen Name Service"... I guess I have to close out all my browser windows. So given that I can't figure out how to log out, I can't replicate this procedure again (sorry, AOL, but I am not going to exit all my browser windows right now)... so I'd be curious to know if anyone else experiences this. If you get a OpenID login screen, do you then just go right in?
I'm not sure there is a huge issue... I mean, you are going to the site to login... to a certain degree the Grant/Deny screen seems redundant in this instance. You still have to go through one screen to allow the relying site access to your ID. And with subsequent sites it seems to do the right thing and pop up the Grant/Deny screen. Is the skipping of the initial Grant/Deny screen really a security issue? (if it turns out to be more than just me?) I don't know yet...
Anyway, kudos to AOL for OpenID-enabling their system... even if there might still be a few bugs to iron out.
This does raise a larger question, too... who do you use as your ID provider? There's a long list of OpenID providers, but if you use AOL most of the time for IM, might it not make sense to use them as your OpenID provider? Or do you want the more granular control provided by some of the others? Where do you establish your online identity? It shall be an interesting question to continue to ponder.
[1] My AIM name might give a clue as to why I don't use it as well... I took it out during the 5 years we lived in Ottawa, and, well, I've just never gotten around to getting a new one now that left there 1.5 years ago...
Google+
