4 ms·

Original OpenID implementation was so simple and the scope of it was so small, i wonder where we got all this complexity

barkingcat 8y ago
for OAuth 2.0 at least, the creator disowned it because the process spun out of control https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529 https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45...
nailer 8y ago
OpenID (not connect) had a weird OpenID URL users had to care about. Mine was something something google something u8. Nobody cared. Sites like HN removed OpenID logins. OpenID died. OpenID Connect just standardised the existing practice of being authorised to use an identity provider as a type of authentication. Edit: actually something something o8: https://www.google.com/accounts/o8/id https://www.google.com/accounts/o8/id Again, this was required for USERS, not developers. This is someone asking how to log in: https://webapps.stackexchange.com/questions/18899/how-do-i-figure-out-my-google-openid-url https://webapps.stackexchange.com/questions/18899/how-do-i-f...
- Nullabillity 8y ago
  This is an implementation issue, not a spec issue. Pages can delegate to another identity provider (primarily used for vanity URLs, for example I could say that https://nullable.se/ https://nullable.se/ should map to my Google OpenID, for example), and the identity provider can claim a different URL than you asked for (for example, Steam always uses https://steamcommunity.com/openid https://steamcommunity.com/openid as the provider, but will claim a different URL for each user). Combine these, and Google would have been perfectly capable of making everyone just type google.com. That they didnt' says more about Google than OpenID. Besides, people were perfectly capable of showing the same pickers back then as you are forced to use with the current OIDC/OAuth2 abomination.
  - nailer 8y ago
    > That they didn't says more about Google than OpenID. HN did the same thing. In fact pretty much every OpenID site implemented this weird expectation. Part of helping a standard get adopted is making sure it's implemented correctly.

barkingcat 8y ago

for OAuth 2.0 at least, the creator disowned it because the process spun out of control https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529 https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45...

nailer 8y ago

OpenID (not connect) had a weird OpenID URL users had to care about. Mine was something something google something u8. Nobody cared. Sites like HN removed OpenID logins. OpenID died. OpenID Connect just standardised the existing practice of being authorised to use an identity provider as a type of authentication. Edit: actually something something o8: https://www.google.com/accounts/o8/id https://www.google.com/accounts/o8/id Again, this was required for USERS, not developers. This is someone asking how to log in: https://webapps.stackexchange.com/questions/18899/how-do-i-figure-out-my-google-openid-url https://webapps.stackexchange.com/questions/18899/how-do-i-f...

Nullabillity 8y ago
This is an implementation issue, not a spec issue. Pages can delegate to another identity provider (primarily used for vanity URLs, for example I could say that https://nullable.se/ https://nullable.se/ should map to my Google OpenID, for example), and the identity provider can claim a different URL than you asked for (for example, Steam always uses https://steamcommunity.com/openid https://steamcommunity.com/openid as the provider, but will claim a different URL for each user). Combine these, and Google would have been perfectly capable of making everyone just type google.com. That they didnt' says more about Google than OpenID. Besides, people were perfectly capable of showing the same pickers back then as you are forced to use with the current OIDC/OAuth2 abomination.
- nailer 8y ago
  > That they didn't says more about Google than OpenID. HN did the same thing. In fact pretty much every OpenID site implemented this weird expectation. Part of helping a standard get adopted is making sure it's implemented correctly.