> OpenID was a good solution Ugh...no. Just no. If you believe that, I'm not sure there's anything I can say that will get through to you...we're just going to

> OpenID was a good solution Ugh...no. Just no. If you believe that, I'm not sure there's anything I can say that will get through to you...we're just going to have diametrically opposed opinions. But let me tell you that I've implemented it quite a few times on various sites and it's been a nightmare every time, so it's not like my 'half-assed' approach was ignorant of it being an option. It was based on specifically discarding that option as poorly conceived, poorly implemented and simply not being an option in many cases. Banks, for example, should never let a 3rd party IDP be part of their authentication process. And if your solution is inapplicable in situations where tight security is required, you've got to ask yourself whether you're actually solving the problem or just requiring users to be aware of two different ways of logging in instead of the one that they currently understand. Even if they do have to remember different passwords for most sites, most people can deal with username/password conceptually in a way that using a third-party IDP confuses them.