3 ms·

> Like... email addresses? Or do you not think it's good to provide a "forgot password" link which emails a reset mechanism? Yeah, but those are for retrieving

by awj 16y ago

> Like... email addresses? Or do you not think it's good to provide a "forgot password" link which emails a reset mechanism? Yeah, but those are for retrieving an account, not for day-to-day logins. I'm only dealing with trouble when someone's email provider goes down and they can't remember their password. With openid I'm in trouble when the provider goes down period. > So your complaint is that OpenID providers aren't mature enough to be reliable enough to last long enough to be worthwhile. Providers like Google, Verisign, Yahoo, and many others of the internet / security / email giants. Being big giants doesn't make them awesome at everything they attempt. Half of this article was griping about Google changing tokens and provider urls. Also, with openid I don't get to pick who I trust to do their job correctly. At the least I shouldn't, if I'm implementing it properly. Maybe if I could I would decide that Google, Verisign and Yahoo can do it well, but I'd rather not depend on MomAndPopsIDShop to hold it together. I don't really get that choice, and instead my user experience is up to them holding up their end of the deal. > Email providers can and do and have made plenty of stupid decisions - one of mine only allows login via plain-text username and password over POP. This applies equally to openid. A dumb implementation can be just about as insecure. > Two of my older ones went belly-up. One got purchased, and transitioned everyone over to a new domain name as they phased out the old one. How is this different? Well, for starters it's a known problem. Also you know the token I'm using to uniquely identify your account, it's the same email that's now become a problem. But if tomorrow your provider decides that, instead of "5AHGFOA12389E" you are "ABNA489AKJ12" ... we're both kind of stuck. You only know your openid, and I only really know the token that just changed. Sure I can ask for even more information from you, but there's a limit on how many hoops I'm willing to jump through before admitting that openid is a bad business decision.

Groxx 16y ago
>Also, with openid I don't get to pick who I trust to do their job correctly. That's probably where we're disagreeing. This is precisely why I like OpenID: it takes logins out of your / site owners' hands, where it's always been, and where it's been abused to no end, and puts it in mine, where I can actually make a few decisions.
- awj 16y ago
  I can understand that opinion, but having the user's ability to access your site be in anyone else's hands is a scary thing. Especially when it can create even nastier customer service issues than a lost password. I'm not really sure what the solution here is, because as a developer I would like to see openid work. Right now it's just hard to argue for.
  - Groxx 16y ago
    I honestly doubt there can be one. A system has to favor one or the other, as giving both equal access opens it to all possible abuse from both sides, rather than just one. As to the customer service issues, if they're having a problem on your site, they're having a problem on every site if they're using OpenID, because their ID has changed everywhere. It's far easier to diagnose the problem there, as it lies wholly (and provably) with their provider, and not with you. More of a headache for you, potentially, people are nuts when they don't get what they want. But at least you have a provable "out" and they have a single place to go for a solution (if there can be one).
- wvenable 16y ago
  What advantage does that provide? I'm not following the whole "takes logins out of site owners hands" logic. It seems like, yes, the site owner doesn't get to see your password but that's about it. On the otherhand, you're sharing a huge amount of information with your OpenID provider about who you are and where you go.
  - Groxx 16y ago
    Unless your OpenID provider is you. Which it can be. Which is not possible with username+password. It's also about not having to trust the site owner to not misuse your password or release it or get hacked, which has happened before (though not to me). Loads of people use the same password on their email as they do on website-X, however stupid that may be. This is essentially giving website-X access to your entire identity, as nearly everything is keyed around your email account. Identity theft, here we come; already a tens-of-billions-of-dollars industry in USA alone. Instead, you choose who you want to trust with that information. Your OpenID provider. And you restrict your logins to 1, instead of N, making it far simpler to use a more secure login for even the most computer-inept.

by awj 16y ago

Groxx 16y ago

>Also, with openid I don't get to pick who I trust to do their job correctly. That's probably where we're disagreeing. This is precisely why I like OpenID: it takes logins out of your / site owners' hands, where it's always been, and where it's been abused to no end, and puts it in mine, where I can actually make a few decisions.

awj 16y ago
I can understand that opinion, but having the user's ability to access your site be in anyone else's hands is a scary thing. Especially when it can create even nastier customer service issues than a lost password. I'm not really sure what the solution here is, because as a developer I would like to see openid work. Right now it's just hard to argue for.
- Groxx 16y ago
  I honestly doubt there can be one. A system has to favor one or the other, as giving both equal access opens it to all possible abuse from both sides, rather than just one. As to the customer service issues, if they're having a problem on your site, they're having a problem on every site if they're using OpenID, because their ID has changed everywhere. It's far easier to diagnose the problem there, as it lies wholly (and provably) with their provider, and not with you. More of a headache for you, potentially, people are nuts when they don't get what they want. But at least you have a provable "out" and they have a single place to go for a solution (if there can be one).
wvenable 16y ago
What advantage does that provide? I'm not following the whole "takes logins out of site owners hands" logic. It seems like, yes, the site owner doesn't get to see your password but that's about it. On the otherhand, you're sharing a huge amount of information with your OpenID provider about who you are and where you go.
- Groxx 16y ago
  Unless your OpenID provider is you. Which it can be. Which is not possible with username+password. It's also about not having to trust the site owner to not misuse your password or release it or get hacked, which has happened before (though not to me). Loads of people use the same password on their email as they do on website-X, however stupid that may be. This is essentially giving website-X access to your entire identity, as nearly everything is keyed around your email account. Identity theft, here we come; already a tens-of-billions-of-dollars industry in USA alone. Instead, you choose who you want to trust with that information. Your OpenID provider. And you restrict your logins to 1, instead of N, making it far simpler to use a more secure login for even the most computer-inept.