4 ms·

"if big websites like yahoo keep not using it, it will stay that way" Not true - openid never took off because it has severe usability issues, not because majo

by alabut 16y ago

"if big websites like yahoo keep not using it, it will stay that way" Not true - openid never took off because it has severe usability issues, not because major sites didn't try to implement it. It's not just an open source/standardized version of Facebook Connect, even though that's how hacker types perceive it. Here's the Yahoo research report on it: http://developer.yahoo.com/blogs/ydn/posts/2008/10/open_id_research/ http://developer.yahoo.com/blogs/ydn/posts/2008/10/open_id_r...

Groxx 16y ago
"severe usability issues" my ass. Nearly all current implementations, absolutely, they are horrible. But would people be saying the same thing if Facebook let you use your profile URL to log in elsewhere? From that point on, the user-visible mechanism to log you in is exactly the same as the "log in with Facebook" buttons that people are now used to using, clearly without "severe usability issues". The implementations haven't been made for the average user. The user-facing implementations have severe usability issues, not the spec.
- jdp23 16y ago
  if the spec has only led to implementations with severe usability issues, what does that imply?
  - gcb 16y ago
    now that's a stretch.
  - Groxx 16y ago
    Absolutely nothing. We interpret sound via air waves colliding with our eardrums causing tiny hairs to vibrate in our inner ears causing electrical signals in our head. What does this imply about what a piano looks like? Or a stereo system? Or a flashbang? It even only extremely slightly implies how sound-creating things function, given that they could inject themselves at any point in that process. They could vibrate air. They could vibrate our jawbones. They could cause electrical impulses directly. And this discounts future creations - maybe we discover a way to induce momentum, vibrating our eardrums without doing so by vibrating the air. And it entirely ignores synaesthesia, whereby we could create sound by looking at a light or smelling a cookie. Or lets take the programmer approach: the spec is an interface. What does that imply about what goes on behind the interface?
- simonw 16y ago
  "But would people be saying the same thing if Facebook let you use your profile URL to log in elsewhere?" Sadly yes. I was an OpenID advocate for years - but the problem is that for the vast majority of people having to type in /anything/ is a recipe for disaster - the "I forgot my username" button on the Yahoo! login screen is used almost as often as the "I forgot my password" one. Telling them to type in a URL (a Ur--what?) will never be even remotely as usable as having them click on the big blue button. That's the hurdle a decentralised system like OpenID needs to cross if it's going to compete with centralised systems like Facebook Connect or Twitter OAuth. In my opinion, the only hope is for browsers to bake OpenID-style decentralised auth in to the browser itself - that's the only way you can get one-button login without ceding control of the Web to a single, central provider like Facebook.
  - cpeterso 16y ago
    > the only hope is for browsers to bake OpenID-style decentralised auth in to the browser itself Do you have any suggestions for how the browser could securely integrate with a server-based auth system like OpenID? Opera has had a web server feature built into their browser. Perhaps the browser could (somehow) act as its own OpenID server. But that would not really prove anything about the user's actual identity. A simpler auth solution that does not lock in users to an ISP email address or Facebook account might be browser support for something like the SuperGenPass bookmarklet [1]. SuperGenPass auto-generates passwords by hashing the website's domain name with a master password (entered every login), producing a unique one-way password for every website. Unlike other password managers, the passwords are not saved locally (so can't be lost or stolen) and they can be generated from any computer (that has access to the generator JavaScript). [1] http://supergenpass.com/ http://supergenpass.com/

by alabut 16y ago

Groxx 16y ago

"severe usability issues" my ass. Nearly all current implementations, absolutely, they are horrible. But would people be saying the same thing if Facebook let you use your profile URL to log in elsewhere? From that point on, the user-visible mechanism to log you in is exactly the same as the "log in with Facebook" buttons that people are now used to using, clearly without "severe usability issues". The implementations haven't been made for the average user. The user-facing implementations have severe usability issues, not the spec.

jdp23 16y ago
if the spec has only led to implementations with severe usability issues, what does that imply?
- gcb 16y ago
  now that's a stretch.
- Groxx 16y ago
  Absolutely nothing. We interpret sound via air waves colliding with our eardrums causing tiny hairs to vibrate in our inner ears causing electrical signals in our head. What does this imply about what a piano looks like? Or a stereo system? Or a flashbang? It even only extremely slightly implies how sound-creating things function, given that they could inject themselves at any point in that process. They could vibrate air. They could vibrate our jawbones. They could cause electrical impulses directly. And this discounts future creations - maybe we discover a way to induce momentum, vibrating our eardrums without doing so by vibrating the air. And it entirely ignores synaesthesia, whereby we could create sound by looking at a light or smelling a cookie. Or lets take the programmer approach: the spec is an interface. What does that imply about what goes on behind the interface?
simonw 16y ago
"But would people be saying the same thing if Facebook let you use your profile URL to log in elsewhere?" Sadly yes. I was an OpenID advocate for years - but the problem is that for the vast majority of people having to type in /anything/ is a recipe for disaster - the "I forgot my username" button on the Yahoo! login screen is used almost as often as the "I forgot my password" one. Telling them to type in a URL (a Ur--what?) will never be even remotely as usable as having them click on the big blue button. That's the hurdle a decentralised system like OpenID needs to cross if it's going to compete with centralised systems like Facebook Connect or Twitter OAuth. In my opinion, the only hope is for browsers to bake OpenID-style decentralised auth in to the browser itself - that's the only way you can get one-button login without ceding control of the Web to a single, central provider like Facebook.
- cpeterso 16y ago
  > the only hope is for browsers to bake OpenID-style decentralised auth in to the browser itself Do you have any suggestions for how the browser could securely integrate with a server-based auth system like OpenID? Opera has had a web server feature built into their browser. Perhaps the browser could (somehow) act as its own OpenID server. But that would not really prove anything about the user's actual identity. A simpler auth solution that does not lock in users to an ISP email address or Facebook account might be browser support for something like the SuperGenPass bookmarklet [1]. SuperGenPass auto-generates passwords by hashing the website's domain name with a master password (entered every login), producing a unique one-way password for every website. Unlike other password managers, the passwords are not saved locally (so can't be lost or stolen) and they can be generated from any computer (that has access to the generator JavaScript). [1] http://supergenpass.com/ http://supergenpass.com/