4 ms·

I sort of think the problem is that many people have multiple OpenId providers. It sort of reduces half the reason you want to use it. Originally OpenId was a w

by zaphar 16y ago

I sort of think the problem is that many people have multiple OpenId providers. It sort of reduces half the reason you want to use it. Originally OpenId was a way to have one authentication for multiple services on the net. However when you have a Google Account, A Facebook account, A Twitter account... problems start happening. Which one did you use to login to this service last time? Part of the problem I think is that the providers don't act as consumers also. If I originally had an open id somewhere then why can't I use it for facebook, Google, Twitter, and whatever else. Each "Provider" that offers a service to me which I want forces me to get yet another OpenId. At this point I think I have rougly 4 different OpenId providers and with Google I have like 4 different id's. This gets unwieldy quick. The technology had promise but the way it was rolled out and adopted by various folks caused it to suck a little. Now I need an OpenId manager in my browser like I needed a password manager before. How is this better?

silencio 16y ago
Yep, this is my problem, not that I actually forgot all the logins to my individual OpenID provider accounts and variants (but when that happens once in a while, that's also a clusterfuck...). I have one for my domain with myOpenID, I have at least one each through google, yahoo, facebook, twitter, livejournal... every site offering those logins uses any combination of all of those, and I can't remember which OpenID I need to use with the site. This is why I can't even remember the last time I posted on Stack Overflow. I once had to email Jeff Atwood because I had managed to create two accounts with two different identities (this was long ago, before you were able to associate multiple OpenID identities to a single user), and to this day I still don't remember which ones work with the user that has the highest reputation. So I don't even bother logging in most of the time, and choose a random login every time I do. OpenID's biggest end-user benefit was supposed to cut down on the number of disparate accounts people tend to have across multiple websites, and it became moot when everyone and their mother decided that they needed to be the be-all end-all of OpenID providers by turning your login details and identity with that website into an OpenID or OpenID type identity.
jerf 16y ago
"Now I need an OpenId manager in my browser like I needed a password manager before. How is this better?" What you really need is delegation. In a webpage, place in the <head>: <link rel="openid.server" href="openID server URL" /> <link rel="openid.delegate" href="openID server" /> with appropriate values. My OpenID is "http://jerf.org". I delegate that to AOL right now, but I can change that to any provider transparently. (The ickiness of using AOL is mitigated by the trivial way in which I can change it; which of the corporate monstrosities auths me isn't very important, and of the various accounts I have they were the first to be a provider.) Having this implemented by your metaphorical grandmother is obviously a problem. Edit: And also, I'd observe that this solves your personal OpenID problem. It doesn't do a thing to solve the problem for a site trying to use OpenID, such as the original article author, because telling everyone to delegate like this is a boil-the-ocean solution in the context of cutting down support calls.
- jdavid 16y ago
  This will likely appeal to the identi.ca and diaspora crowd, but will not appeal to the facebook crowd. there are two problems with OpenID. #1 the UX has been killed by committee more than once. ( i should know I worked on it. ) #2 OpenID does not offer value for one, let alone many OpenIDs. Whether we like it or not. We need to get activitystrea.ms and the browser vendors to probably make some collective bets on identity. Password managers make some bets on input fields that use the password type to manage login pairs, but I think we need to take this further. I think we need to start having browsers connect cookies and openid redirect flows to login pairs. I think we can observe openid login flows in the browser and... remember them! I think we can link that to a browser profile, and I think we can pair that to a cookie set. I think smart-identity-browsers can suggest OpenIDs and make OpenID NASCAR obsolete, or at-least auto create a popular field of buttons, rather than making that site specific. This is probably not enough space to discuss in detail how I think the tech can mature. but i think it's obvious that the future of the web is mobile, and is identity based. these interfaces don't need to get a little bit simpler, they need to get a lot simpler. they need to work on mobile phones. a lot of the work i have done on OpenID comes to naught when you try to copy that experience for mobile phones.
jellicle 16y ago
Exactly. Each of the big players has incentive to be an OpenID provider (control everyone's logins!) but not be an OpenID receiver (accept AOL's logins? are you kidding?). Nobody at OpenId seems to have quite thought through the incentives here. Identification is not in fact a technical problem. That's trivial. It's a business/social problem. The problem is, "How can I make multi-billion dollar companies want to outsource identification to someone else, given that they're reasonably bright and given that every time in the past that someone else has inserted themselves into another's business, things have gone badly for the insertee?" Businesses look at situations where companies like Ticketmaster and OpenTable have successfully inserted themselves between pre-existing businesses and their customers, and siphoned off a lot of the value of those customers. Then they say, "Gee, maybe I should learn from that and not let someone do that to me." And then the OpenID geeks come calling saying they've got a great solution where all you have to do is outsource your accounts to another multi-billion dollar company and everything will be cool, that other company TOTALLY won't steal your business or anything.

by zaphar 16y ago

silencio 16y ago

Yep, this is my problem, not that I actually forgot all the logins to my individual OpenID provider accounts and variants (but when that happens once in a while, that's also a clusterfuck...). I have one for my domain with myOpenID, I have at least one each through google, yahoo, facebook, twitter, livejournal... every site offering those logins uses any combination of all of those, and I can't remember which OpenID I need to use with the site. This is why I can't even remember the last time I posted on Stack Overflow. I once had to email Jeff Atwood because I had managed to create two accounts with two different identities (this was long ago, before you were able to associate multiple OpenID identities to a single user), and to this day I still don't remember which ones work with the user that has the highest reputation. So I don't even bother logging in most of the time, and choose a random login every time I do. OpenID's biggest end-user benefit was supposed to cut down on the number of disparate accounts people tend to have across multiple websites, and it became moot when everyone and their mother decided that they needed to be the be-all end-all of OpenID providers by turning your login details and identity with that website into an OpenID or OpenID type identity.

jerf 16y ago

"Now I need an OpenId manager in my browser like I needed a password manager before. How is this better?" What you really need is delegation. In a webpage, place in the <head>: <link rel="openid.server" href="openID server URL" /> <link rel="openid.delegate" href="openID server" /> with appropriate values. My OpenID is "http://jerf.org". I delegate that to AOL right now, but I can change that to any provider transparently. (The ickiness of using AOL is mitigated by the trivial way in which I can change it; which of the corporate monstrosities auths me isn't very important, and of the various accounts I have they were the first to be a provider.) Having this implemented by your metaphorical grandmother is obviously a problem. Edit: And also, I'd observe that this solves your personal OpenID problem. It doesn't do a thing to solve the problem for a site trying to use OpenID, such as the original article author, because telling everyone to delegate like this is a boil-the-ocean solution in the context of cutting down support calls.

jdavid 16y ago
This will likely appeal to the identi.ca and diaspora crowd, but will not appeal to the facebook crowd. there are two problems with OpenID. #1 the UX has been killed by committee more than once. ( i should know I worked on it. ) #2 OpenID does not offer value for one, let alone many OpenIDs. Whether we like it or not. We need to get activitystrea.ms and the browser vendors to probably make some collective bets on identity. Password managers make some bets on input fields that use the password type to manage login pairs, but I think we need to take this further. I think we need to start having browsers connect cookies and openid redirect flows to login pairs. I think we can observe openid login flows in the browser and... remember them! I think we can link that to a browser profile, and I think we can pair that to a cookie set. I think smart-identity-browsers can suggest OpenIDs and make OpenID NASCAR obsolete, or at-least auto create a popular field of buttons, rather than making that site specific. This is probably not enough space to discuss in detail how I think the tech can mature. but i think it's obvious that the future of the web is mobile, and is identity based. these interfaces don't need to get a little bit simpler, they need to get a lot simpler. they need to work on mobile phones. a lot of the work i have done on OpenID comes to naught when you try to copy that experience for mobile phones.

jellicle 16y ago

Exactly. Each of the big players has incentive to be an OpenID provider (control everyone's logins!) but not be an OpenID receiver (accept AOL's logins? are you kidding?). Nobody at OpenId seems to have quite thought through the incentives here. Identification is not in fact a technical problem. That's trivial. It's a business/social problem. The problem is, "How can I make multi-billion dollar companies want to outsource identification to someone else, given that they're reasonably bright and given that every time in the past that someone else has inserted themselves into another's business, things have gone badly for the insertee?" Businesses look at situations where companies like Ticketmaster and OpenTable have successfully inserted themselves between pre-existing businesses and their customers, and siphoned off a lot of the value of those customers. Then they say, "Gee, maybe I should learn from that and not let someone do that to me." And then the OpenID geeks come calling saying they've got a great solution where all you have to do is outsource your accounts to another multi-billion dollar company and everything will be cool, that other company TOTALLY won't steal your business or anything.