In time for #CIS2012, the OpenID Foundation and Google released a new version of accountchooser.com, a set of open-source software components that, as the name indicates, lets you choose your account on the web.
Except that it doesn’t.
Compare with a bank. Let’s say I want to check my balance at my bank, the accountchooser.com way.
Bank: “Hello, glad you could come in, please prove to me who you are so I can help you with your business today. We accept driver’s licenses, passports and a few other things for authentication purposes.”
[That’s the equivalent of a site displaying the accountchooser.com list of identity provider icons, shown to the right.]
Me: “Alright, here’s my California driver’s license with serial number 112233”.
[I select my gmail account]
Bank: “Alright, I believe it’s you.”
[The site accepts the crypto sent by Google to the site.]
Bank: “Your account balance is $100.”
Me: “Wait, is that my checking or my savings account?”
Bank: “I have no idea what you are talking about. The account with California driver’s license 112233 has a balance of $100”.
[Accountchooser.com uses the identifier of the form of identification that I use – e.g. my Gmail e-mail address – as the identifier of my checking account! We can tell, because my e-mail address or equivalent is shown prominently as the account identifier after I have logged in. Imagine if a bank did that. Not just the privacy implications are bad; it also means I can never really have two checking accounts with the same bank!]
Me: “That must be my checking account. But what about my savings account?”
Bank: “If you have another account, I’ll be happy to help you. We accept driver’s licenses, passports and a few other things for authentication purposes.”
[That’s the equivalent of logging out and back in through accountchooser.com, or of doing the Google multiple “accounts” thing – which, by the way, has the same habits, and where accountchooser.com was conceived as far as I know.]
Me: “But I just authenticated. You know it is me because I haven’t left the building yet (aka logged out). Do you mean to tell me I need to bring my passport (a different identity) so I can find out the balance on my savings account?”
Bank: “If your savings account has the serial number of your passport, yes. But I don’t know whether you set up your savings account with your passport, or with your social security card or other identification.”
[Because according to accountchooser.com, the only way I can have another account is to use different identity papers.]
Me: “But my savings account is a joint account with my wife. Are you telling me that the only way she can get at our joint account is if she brings my passport, and pretends to be me?”
Bank: “What’s a joint account?”
[Yes, that is the way accountchooser.com and the Google accounts system works. Shared passwords is the only choice for joint accounts.]
Enough of the bank. If accountchooser.com actually were (an account chooser), I would authenticate once with a site and have access to several accounts at the site, some of which could be shared with others. Just like I do it with a bank.
Instead, accountchooser.com at best is an “identification chooser”. As in: “choose whether you want to identify with a driver’s license or passport.” The more important functionality — choosing which account I want to use after I have authenticated, instead of just choosing the form of identification — doesn’t exist (yet?). In spite of the name “account chooser”.
Let’s hope the OpenID Account Chooser working group lives up to its name and one day will let me choose accounts. In which case, I might actually use accountchooser.