Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?
OpenID uses an Identity Provider to confirm that a user owns a particular URL. Why not use a public key identifier. If the user can decrypt information encrypted with the public key, then they must own that public key. This would remove the need for identity providers and give users complete control over their own Identity.
The simple answer is that of course you could do that but then you would have to manage the infrastructure to cope with key management, and some organisations do exactly that.
It is a challenge, though, at large scale, so why not offload some of that onto a trusted provider? That way they can focus on the identity management and you can focus on your business.
Simple outsourcing model in many respects.
