4 ms·

That's not serious, is it? The real point is, that you cannot be sure that you can identify _your customers_. The providers change, you greet them with "Hey, w

That's not serious, is it? The real point is, that you cannot be sure that you can identify _your customers_. The providers change, you greet them with "Hey, welcome. What do you want to buy here?" instead of saying "Hey, Groxx. Glad you are back. Feel free to use X, Y and Z that you gave us money for in the past". I really like OpenID, but insights like this seriously scare me. And they are _not_ customer friendly when they _don't_ work. Understand that you have no control over that "when" though - you rely on someone else to allow your paying customers to use your (purchased) service.

Groxx 16y ago
That's the same situation as we have right now, where their login or their email are identical points of failure. Forget one / lose access to your email, and you lose the ability to get back in, so people make a new account. It's not like having usernames and passwords is preventing this. As to providers changing, that's where you allow multiple OpenIDs per person, as fallbacks / alternate ways of signing in. So long as they control one, they can control all. It's not OpenID's fault few sites do this, it's the epic adherence to preferring username + password columns in databases instead of a separate table which would allow for more than one.
- awj 16y ago
  ... except logins and emails are known, understood points of failure that tend to fail closed. If I forget my login I can't access the website, but I can usually go to the website and play email bingo until I hit the one I used. If my email access goes down, I still can't access the website, but I know why and have bigger problems. If I log in with the wrong openid provider ... provider bingo is the ideal case. Otherwise I get in but it looks like my stuff on the website I'm logging into got wiped out. Obviously to most people here it would look more like they used the wrong provider, but that only qualifies openid as a solution for techies. That's a much more serious customer problem from an end-user standpoint. Telling people they can register multiple providers with their account is a band-aid on a bullet wound. And that's just when things are working as intended. Idiot providers, bad implementations, openid servers going down, all of these things add even more potential to screw things up for you.
  - Groxx 16y ago
    >Otherwise I get in but it looks like my stuff on the website I'm logging into got wiped out. What? No. Only if the site presumes a brand-new OpenID means a brand-new account, and automatically creates it for you. And it'll probably be asking you for a username and email - at which point it likely will throw a database constraint, telling you you can't use that username or email. And the vast majority I've encountered ask you if you want to create an account under that OpenID. And this is also no different than, say, Instapaper, where just entering an email / username offers to create a new one. It could easily do so automatically. What if you forgot you had one under a different email? You're just conflating human forgetfulness and poor website design with inherent problems of OpenID which don't really exist. A fair number of sites allow you to register multiple emails. Is this not a band-aid to the bullet wound which email accounts are? On the flip side, we have idiot websites storing passwords in clear-text, or hashed without salting, all of which means if they get hacked they get thousands of accounts, likely thousands of email accounts as well (as many / enough use the same password). With OpenID, they'll just get your public OpenID URL - whoop-de-doo. In fact, I'd say that the (rarely used) adequate security measures to protect your password are band-aids on the bad implementation that is username-and-password.
    - awj 16y ago
      Yeah, still not buying it. There's no way in hell I would think it's good to put a third party between my site and my users when that party can go down or change the only identifier I have. I understand password pain, but so does everyone else. The song and dance is annoying, but known. I'd rather spend the time dealing with an explosion of openid misimplementations adding useful features that don't carry a risk of pissing off my users.
      - Groxx 16y ago
        >There's no way in hell I would think it's good to put a third party between my site and my users when that party can go down or change the only identifier I have. Like... email addresses? Or do you not think it's good to provide a "forgot password" link which emails a reset mechanism? Any other means of re-gaining access, like "secret questions", work for both lost email accounts and OpenID, and any site which asks for an email address to mail "forgot"-like requests to has all the capabilities of any system which has an email address. So your complaint is that OpenID providers aren't mature enough to be reliable enough to last long enough to be worthwhile. Providers like Google, Verisign, Yahoo, and many others of the internet / security / email giants. If they've made stupid decisions in the past, that's an entirely different problem. Email providers can and do and have made plenty of stupid decisions - one of mine only allows login via plain-text username and password over POP. Two of my older ones went belly-up. One got purchased, and transitioned everyone over to a new domain name as they phased out the old one. How is this different?

Groxx 16y ago

That's the same situation as we have right now, where their login or their email are identical points of failure. Forget one / lose access to your email, and you lose the ability to get back in, so people make a new account. It's not like having usernames and passwords is preventing this. As to providers changing, that's where you allow multiple OpenIDs per person, as fallbacks / alternate ways of signing in. So long as they control one, they can control all. It's not OpenID's fault few sites do this, it's the epic adherence to preferring username + password columns in databases instead of a separate table which would allow for more than one.

awj 16y ago
... except logins and emails are known, understood points of failure that tend to fail closed. If I forget my login I can't access the website, but I can usually go to the website and play email bingo until I hit the one I used. If my email access goes down, I still can't access the website, but I know why and have bigger problems. If I log in with the wrong openid provider ... provider bingo is the ideal case. Otherwise I get in but it looks like my stuff on the website I'm logging into got wiped out. Obviously to most people here it would look more like they used the wrong provider, but that only qualifies openid as a solution for techies. That's a much more serious customer problem from an end-user standpoint. Telling people they can register multiple providers with their account is a band-aid on a bullet wound. And that's just when things are working as intended. Idiot providers, bad implementations, openid servers going down, all of these things add even more potential to screw things up for you.
- Groxx 16y ago
  >Otherwise I get in but it looks like my stuff on the website I'm logging into got wiped out. What? No. Only if the site presumes a brand-new OpenID means a brand-new account, and automatically creates it for you. And it'll probably be asking you for a username and email - at which point it likely will throw a database constraint, telling you you can't use that username or email. And the vast majority I've encountered ask you if you want to create an account under that OpenID. And this is also no different than, say, Instapaper, where just entering an email / username offers to create a new one. It could easily do so automatically. What if you forgot you had one under a different email? You're just conflating human forgetfulness and poor website design with inherent problems of OpenID which don't really exist. A fair number of sites allow you to register multiple emails. Is this not a band-aid to the bullet wound which email accounts are? On the flip side, we have idiot websites storing passwords in clear-text, or hashed without salting, all of which means if they get hacked they get thousands of accounts, likely thousands of email accounts as well (as many / enough use the same password). With OpenID, they'll just get your public OpenID URL - whoop-de-doo. In fact, I'd say that the (rarely used) adequate security measures to protect your password are band-aids on the bad implementation that is username-and-password.
  - awj 16y ago
    Yeah, still not buying it. There's no way in hell I would think it's good to put a third party between my site and my users when that party can go down or change the only identifier I have. I understand password pain, but so does everyone else. The song and dance is annoying, but known. I'd rather spend the time dealing with an explosion of openid misimplementations adding useful features that don't carry a risk of pissing off my users.
    - Groxx 16y ago
      >There's no way in hell I would think it's good to put a third party between my site and my users when that party can go down or change the only identifier I have. Like... email addresses? Or do you not think it's good to provide a "forgot password" link which emails a reset mechanism? Any other means of re-gaining access, like "secret questions", work for both lost email accounts and OpenID, and any site which asks for an email address to mail "forgot"-like requests to has all the capabilities of any system which has an email address. So your complaint is that OpenID providers aren't mature enough to be reliable enough to last long enough to be worthwhile. Providers like Google, Verisign, Yahoo, and many others of the internet / security / email giants. If they've made stupid decisions in the past, that's an entirely different problem. Email providers can and do and have made plenty of stupid decisions - one of mine only allows login via plain-text username and password over POP. Two of my older ones went belly-up. One got purchased, and transitioned everyone over to a new domain name as they phased out the old one. How is this different?