3 ms·
How online security cards fails (or how security economics trumps engineering)
- patio11 17y agoI am sincerely interested in hearing the arguments for why OpenID counts as "properly designed". I implemented it for my day job. The experience both as a relying party and as an end user is miserable, and (though not relevant to our implementation) I question the security wisdom of teaching users that any random site on the Internet is going to ask for their Yahoo/Gmail password and that giving it to them is OK.
- tptacek 17y agoThat is a genuinely good question.
- seldo 17y agoI am a major anti-fan of OpenID, but the idea is that these sites will not ask you for your Yahoo/Gmail password. Instead, they will bounce you to Yahoo/Google/whoever (where it's assumed you'll usually already be logged-in), which will ask you for permission in a standardized, recognizable way. My major objection to OpenID is that it takes a single-site registration/login experience, with one consistent look and feel, and throws two extra HTTP requests and a completely different look and feel into the mix. To me that makes the experience more confusing and inconvenient, not less.
- billpg 17y agoI like OpenID and wish more places would use it, but that's only because I can recognise a dodgy Google sign-in when I see it. For the masses, the browser bounce is a big problem, as we're relying on the user to recognise a genuine login page (as you noted). I'd prefer to configure the browser with my OpenID and let that deal with the request.