I don't understand most of the arguments centering around "single point of failure."
Not too long ago I was a victim of partial Identity Theft; somebody gained access to my credit card information and started making random charges. My credit card was a single point of failure for my finances. It took me a long time to figure this out and to fix it considering I was stuck in Afghanistan at the time, but a phone call and explanation to American Express is all it took to get my card reissued and the charges removed.
You can't do this when you're using passwords. If somebody compromises your "strong" password and changes the password at important sites before you find out, you're pretty much screwed. You could use "I forgot my password," but that same password is likely on your e-mail, so forget that.
With OpenID, there are fixes for this. Say, for instance, the ability to completely disable it if you've used it recently and have the browser cookie. Okay, so now you can't get to your bank account, but neither can the person using your OpenID. You could then use some sort of other verification method to ensure you're the actual owner and reset it.
But forget all this; consider probability! A SSN is basically a single point of failure for your identity; it identifies you specifically and could not possibly represent somebody else. That doesn't mean that the military actually worries about the fact that your SSN is used for everything, including signing into chow. I can't even fathom how many thousands of documents out there have my Social on them. The reason they don't care is because being a victim of identity theft is pretty rare, even when hundreds or thousands of people see your SSN every single day.
I don't understand most of the arguments centering around "single point of failure."
Part of the problem is that the terminology is misleading. You can, in fact, have multiple "single points of failure".
A better term is "central point of failure". Your email account is a central point of failure -- once it is compromised, an energetic black hat can use "forgotten password" links all over the web to compromise many other things. (Assuming that your usernames are guessable, which they often are.)
If you only have one central point of failure, it's also a "single" point of failure. Unfortunately, once you link a bunch of logins to your OpenID provider it becomes a second central point of failure. The black hat can compromise a slew of accounts by either getting your OpenID password or your email password.
Now, at some point, mud is mud, and you can't make it muddier by dumping mud on it. And, at some point, insecure is insecure, so it really may be silly to object to OpenID on central-point-of-failure grounds, because you've already got an even bigger problem with email. But I think it depends on the details. And, at best, you're playing for a tie: "OpenID -- at least as secure as the insecure thing you're using now." is not a great rallying cry.
Not too long ago I was a victim of partial Identity Theft; somebody gained access to my credit card information and started making random charges. My credit card was a single point of failure for my finances. It took me a long time to figure this out and to fix it considering I was stuck in Afghanistan at the time, but a phone call and explanation to American Express is all it took to get my card reissued and the charges removed.
You can't do this when you're using passwords. If somebody compromises your "strong" password and changes the password at important sites before you find out, you're pretty much screwed. You could use "I forgot my password," but that same password is likely on your e-mail, so forget that.
With OpenID, there are fixes for this. Say, for instance, the ability to completely disable it if you've used it recently and have the browser cookie. Okay, so now you can't get to your bank account, but neither can the person using your OpenID. You could then use some sort of other verification method to ensure you're the actual owner and reset it.
But forget all this; consider probability! A SSN is basically a single point of failure for your identity; it identifies you specifically and could not possibly represent somebody else. That doesn't mean that the military actually worries about the fact that your SSN is used for everything, including signing into chow. I can't even fathom how many thousands of documents out there have my Social on them. The reason they don't care is because being a victim of identity theft is pretty rare, even when hundreds or thousands of people see your SSN every single day.