4 ms·

I recently ripped standard accounts out of my web app and put in OpenID support with the ability to assign a password optionally in case all your OpenID provide

I recently ripped standard accounts out of my web app and put in OpenID support with the ability to assign a password optionally in case all your OpenID providers magically go down at once. I'm very sold on some kind of login/password non-proliferation treaty and the general idea behind stopping the DRY nonsense around avatars, favorite books, favorite movies, quotes, yada yada. I have two problems with OpenID. First, big service providers seem to be offering OpenID but not allowing you to use it on their site. I know the market reason behind this, but that's just disrespectful to users. Until they change this, I don't see it getting enough exposure to convince non-early-adopting mid-tier or low-end sites that they should support it as well. Second, OpenID doesn't seem to really carry any of that other repetitive profile data with it and only solves the username/password situation. Until more value can be achieved, it seems like finding a good username and trying to sign up for new services before someone takes it isn't that bad. I just don't see OpenID making it yet. I was hoping Clickpass would make some headway, but that definitely hasn't made it out of the technical circle and I don't see their list of supported sites increasing these past few months which makes me nervous. I also find OpenID hard to explain to people who are actually smart and fairly technical. It seems to fill people with low-level dread and confusion. I try explaining it as "a way to log in to a site using an account you already have at another site." That's the most condensed I can get the explanation.

tlrobinson 18y ago
OpenID does have support for other profile data: http://openid.net/specs/openid-attribute-exchange-1_0.html http://openid.net/specs/openid-attribute-exchange-1_0.html Also, for simple avatar sharing, check out http://gravatar.com http://gravatar.com
- bct 18y ago
  Or more in the spirit of decentralization, http://pavatar.com/ http://pavatar.com/
  - justindz 18y ago
    I'm planning to switch from local avatars to something else. Thanks for the link. I'll check it out. Regarding OpenID, all the services I've tested with so far don't even return email, let alone anything else. Is this a heavily under-used aspect of the protocol on the provider side?
brlewis 18y ago
I think Clickpass has the potential to give OpenID a lot of traction among non-early-adopting mid-tier or low-end sites. I gave them some advice along those lines here: http://ourdoings.com/ourdoings-startup/2008-05-02 http://ourdoings.com/ourdoings-startup/2008-05-02
mechanical_fish 18y ago
I also find OpenID hard to explain to people who are actually smart and fairly technical. It seems to fill people with low-level dread and confusion. This is one of the fundamental reasons why OpenID is a failure. Its complexity-to-utility ratio is way out of whack. OpenID always reminds me of one of Spolsky's lines: For some reason most people seem to be born without the part of the brain that understands pointers. Pointers require a complex form of doubly-indirected thinking that some people just can’t do, and it’s pretty crucial to good programming. What is OpenID? It's a system that asks you, not for a username and password, but for a pointer to a site that wants your username and password. And, lo, Spolsky is right: it causes many, many people's heads to explode. Nevertheless, if OpenID prevented cancer everyone on Earth would try to figure it out. There'd be special schools to teach it. But all OpenID does is replace usernames and passwords. Most people use the same ones on every site. Or they have cookies turned on so they rarely have to login, and they use email reminders on those rare occasions when they do. Or they pay their $35 for 1password and just solve the problem. There are a few use cases that can't be solved like this, but not enough of them to justify the overhead of OpenID for most people. OpenID might have a future as a coder's tool, like SSH. Coders can learn to use the protocol fairly quickly, and they're more likely to understand the security tradeoffs.

tlrobinson 18y ago

OpenID does have support for other profile data: http://openid.net/specs/openid-attribute-exchange-1_0.html http://openid.net/specs/openid-attribute-exchange-1_0.html Also, for simple avatar sharing, check out http://gravatar.com http://gravatar.com

bct 18y ago
Or more in the spirit of decentralization, http://pavatar.com/ http://pavatar.com/
- justindz 18y ago
  I'm planning to switch from local avatars to something else. Thanks for the link. I'll check it out. Regarding OpenID, all the services I've tested with so far don't even return email, let alone anything else. Is this a heavily under-used aspect of the protocol on the provider side?

brlewis 18y ago

I think Clickpass has the potential to give OpenID a lot of traction among non-early-adopting mid-tier or low-end sites. I gave them some advice along those lines here: http://ourdoings.com/ourdoings-startup/2008-05-02 http://ourdoings.com/ourdoings-startup/2008-05-02

mechanical_fish 18y ago

I also find OpenID hard to explain to people who are actually smart and fairly technical. It seems to fill people with low-level dread and confusion. This is one of the fundamental reasons why OpenID is a failure. Its complexity-to-utility ratio is way out of whack. OpenID always reminds me of one of Spolsky's lines: For some reason most people seem to be born without the part of the brain that understands pointers. Pointers require a complex form of doubly-indirected thinking that some people just can’t do, and it’s pretty crucial to good programming. What is OpenID? It's a system that asks you, not for a username and password, but for a pointer to a site that wants your username and password. And, lo, Spolsky is right: it causes many, many people's heads to explode. Nevertheless, if OpenID prevented cancer everyone on Earth would try to figure it out. There'd be special schools to teach it. But all OpenID does is replace usernames and passwords. Most people use the same ones on every site. Or they have cookies turned on so they rarely have to login, and they use email reminders on those rare occasions when they do. Or they pay their $35 for 1password and just solve the problem. There are a few use cases that can't be solved like this, but not enough of them to justify the overhead of OpenID for most people. OpenID might have a future as a coder's tool, like SSH. Coders can learn to use the protocol fairly quickly, and they're more likely to understand the security tradeoffs.