6 ms·

This will likely appeal to the identi.ca and diaspora crowd, but will not appeal to the facebook crowd. there are two problems with OpenID. #1 the UX has be

by jdavid 16y ago

This will likely appeal to the identi.ca and diaspora crowd, but will not appeal to the facebook crowd. there are two problems with OpenID. #1 the UX has been killed by committee more than once. ( i should know I worked on it. ) #2 OpenID does not offer value for one, let alone many OpenIDs. Whether we like it or not. We need to get activitystrea.ms and the browser vendors to probably make some collective bets on identity. Password managers make some bets on input fields that use the password type to manage login pairs, but I think we need to take this further. I think we need to start having browsers connect cookies and openid redirect flows to login pairs. I think we can observe openid login flows in the browser and... remember them! I think we can link that to a browser profile, and I think we can pair that to a cookie set. I think smart-identity-browsers can suggest OpenIDs and make OpenID NASCAR obsolete, or at-least auto create a popular field of buttons, rather than making that site specific. This is probably not enough space to discuss in detail how I think the tech can mature. but i think it's obvious that the future of the web is mobile, and is identity based. these interfaces don't need to get a little bit simpler, they need to get a lot simpler. they need to work on mobile phones. a lot of the work i have done on OpenID comes to naught when you try to copy that experience for mobile phones.

jerf 16y ago
I find myself uncertain if you are actually replying to me, and if so, if you understand what I mean by delegation. I thought more people knew about this, but in the past few hours I continue to see a lot of comments that leads me to believe this is not common knowledge and that not everybody understood what delegation is. When I give my open ID to a site (usually blogger.com to make a comment), I actually type in "jerf.org" after the http:// http:// , with nothing else. I do not have a provider set up, which I looked into but is a pain in the bum, and, as it turns out, entirely unnecessary. Instead, the OpenID consumer hits the page I gave (my domain's front page, as it turns out), finds those tags, redirects to "whatever those tags say today", and then I log in that way. When I have successfully logged in with the delegated service, then I have successfully authenticated myself as "http://jerf.org". I say "whatever those tags say today" because if I change those tags on that page to delegate to Google, suddenly I can log in with Google, but I will still be authenticated as "http://jerf.org". If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along, I'm "http://jerf.org". This layer of indirection solved all the problems I had with the idea. I don't have "many" OpenIDs, the phrase of yours that led me to wonder if you (and perhaps others) aren't following me here. I have one: http://jerf.org. Of course like everybody else I can't even count the number of accounts I have with various OpenID providers, but I don't care; http://jerf.org is my OpenID, and will be until I no longer have the domain. I also don't know why it would "appeal" to one of the crowds you listed, but not others. The crowd it "appeals" to is the crowd that has control over a website that includes the ability to set arbitrary tags into the heading of a webpage, rather than a pre-canned HTML template that can't be touched. Unfortunately, rather fewer people have websites with that amount of control than I'd like.
- mechanical_fish 16y ago
  http://jerf.org is my OpenID, and will be until I no longer have the domain. This is precisely my problem. I don't want to commit to maintaining a webpage at a given domain with a given set of headers for the rest of my life. Imagine if OpenID had been designed in 1991. Perhaps it would have been called "GopherID". And I might still have my GopherID from 1991, provided I had kept up the Gopher server that was delegating it, and could find another (trustworthy!) person on this Earth who would bother to operate a reliable GopherID server eighteen years after it mattered. You see the problem? The web is barely old enough to vote. Any identity that ties me to some web standard of 2010 is as ephemeral as the morning dew, eight-track tapes, and the Commodore 64 floppy disk. Meanwhile, I just visited Slashdot for the first time in years. My user ID is only three digits, but my login still works. It's a username and a password, it's built out of text, the protocol is obvious, and it's going to work as long as Slashdot works.
  - vog 16y ago
    and it's going to work as long as Slashdot works This would be true as well if you'd use OpenID. OpenID dies when HTTP web services die, but then Slashdot will die, too.
- lmz 16y ago
  "If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along," I doubt that. "http://jerf.org http://jerf.org is a string that you type into the OpenID box ("endpoint URL"?), not the ID itself. I use Google Apps and set my site up using an X-XRDS-Location header so I can type in "http://id.example.com http://id.example.com into the box, but the identity the site gets is something like "http://example.com/openid?id=123456789 http://example.com/openid?id=123456789. This identity will probably change if I switch to using AOL.
  - jerf 16y ago
    So, I just tried this, and it seems the answer is "it depends". AOL actually let me appear as "jerf.org", so it is not unreasonable that I thought this was the case. When I switched to using Yahoo, my OpenID got translated back to their idea of my id when I used it to log in. And I started flipping out, but decided to verify with another source before screaming too much. So I signed up for myOpenID and delegated to them, and once again I could appear as "jerf.org". I verified this using StackOverflow; with Yahoo I ended up on one account consistently, but with myOpenID and AOL I ended up on the "jerf.org" account regardless. I also verified StackOverflow was actually hitting my site on each request and not just caching my page. So unless I screwed up, it is possible for it to work the way I describe, and it is possible for it to work the way you describe, depending. I'm calmed back down, but in general that's pretty worthless. I can not imagine why it should not always work the way I describe, it's the entire bloody point. Providers shouldn't even be able to screw me over that way.

by jdavid 16y ago

jerf 16y ago

I find myself uncertain if you are actually replying to me, and if so, if you understand what I mean by delegation. I thought more people knew about this, but in the past few hours I continue to see a lot of comments that leads me to believe this is not common knowledge and that not everybody understood what delegation is. When I give my open ID to a site (usually blogger.com to make a comment), I actually type in "jerf.org" after the http:// http:// , with nothing else. I do not have a provider set up, which I looked into but is a pain in the bum, and, as it turns out, entirely unnecessary. Instead, the OpenID consumer hits the page I gave (my domain's front page, as it turns out), finds those tags, redirects to "whatever those tags say today", and then I log in that way. When I have successfully logged in with the delegated service, then I have successfully authenticated myself as "http://jerf.org". I say "whatever those tags say today" because if I change those tags on that page to delegate to Google, suddenly I can log in with Google, but I will still be authenticated as "http://jerf.org". If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along, I'm "http://jerf.org". This layer of indirection solved all the problems I had with the idea. I don't have "many" OpenIDs, the phrase of yours that led me to wonder if you (and perhaps others) aren't following me here. I have one: http://jerf.org. Of course like everybody else I can't even count the number of accounts I have with various OpenID providers, but I don't care; http://jerf.org is my OpenID, and will be until I no longer have the domain. I also don't know why it would "appeal" to one of the crowds you listed, but not others. The crowd it "appeals" to is the crowd that has control over a website that includes the ability to set arbitrary tags into the heading of a webpage, rather than a pre-canned HTML template that can't be touched. Unfortunately, rather fewer people have websites with that amount of control than I'd like.

mechanical_fish 16y ago
http://jerf.org is my OpenID, and will be until I no longer have the domain. This is precisely my problem. I don't want to commit to maintaining a webpage at a given domain with a given set of headers for the rest of my life. Imagine if OpenID had been designed in 1991. Perhaps it would have been called "GopherID". And I might still have my GopherID from 1991, provided I had kept up the Gopher server that was delegating it, and could find another (trustworthy!) person on this Earth who would bother to operate a reliable GopherID server eighteen years after it mattered. You see the problem? The web is barely old enough to vote. Any identity that ties me to some web standard of 2010 is as ephemeral as the morning dew, eight-track tapes, and the Commodore 64 floppy disk. Meanwhile, I just visited Slashdot for the first time in years. My user ID is only three digits, but my login still works. It's a username and a password, it's built out of text, the protocol is obvious, and it's going to work as long as Slashdot works.
- vog 16y ago
  and it's going to work as long as Slashdot works This would be true as well if you'd use OpenID. OpenID dies when HTTP web services die, but then Slashdot will die, too.
lmz 16y ago
"If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along," I doubt that. "http://jerf.org http://jerf.org is a string that you type into the OpenID box ("endpoint URL"?), not the ID itself. I use Google Apps and set my site up using an X-XRDS-Location header so I can type in "http://id.example.com http://id.example.com into the box, but the identity the site gets is something like "http://example.com/openid?id=123456789 http://example.com/openid?id=123456789. This identity will probably change if I switch to using AOL.
- jerf 16y ago
  So, I just tried this, and it seems the answer is "it depends". AOL actually let me appear as "jerf.org", so it is not unreasonable that I thought this was the case. When I switched to using Yahoo, my OpenID got translated back to their idea of my id when I used it to log in. And I started flipping out, but decided to verify with another source before screaming too much. So I signed up for myOpenID and delegated to them, and once again I could appear as "jerf.org". I verified this using StackOverflow; with Yahoo I ended up on one account consistently, but with myOpenID and AOL I ended up on the "jerf.org" account regardless. I also verified StackOverflow was actually hitting my site on each request and not just caching my page. So unless I screwed up, it is possible for it to work the way I describe, and it is possible for it to work the way you describe, depending. I'm calmed back down, but in general that's pretty worthless. I can not imagine why it should not always work the way I describe, it's the entire bloody point. Providers shouldn't even be able to screw me over that way.