6 ms·

StackOverflow should change absolutely nothing about their login process. It is perfect Maybe it works for you, but I'm still utterly confused about how to log

StackOverflow should change absolutely nothing about their login process. It is perfect Maybe it works for you, but I'm still utterly confused about how to login. But hey, I only have about 25 years of coding and online experience. To be fair, it's not SO's fault.

Simucal 16y ago
I can see why a non tech-savvy user would be confused by OpenID but I it surprises me how many programmers are confused by it. On the login page they list a bunch of common providers you can login with if you already have an account with them: Google, Yahoo, AOL, Facebook, etc. Click their icon, type in your credentials. If you don't have an account with one of those or don't wish to use them then it has a big register link to sign up with a myOpenID account.
- chc 16y ago
  You're making the same mistake as people who try to get programmers to fix their printer because programmers are "computer people." Competence with one technology does not confer instant familiarity with another — and however clear you might find OpenID, just the array of company logos alone is kind of overwhelming and highly unusual. Pretty much the opposite of "Don't make me think."
  - Locke1689 16y ago
    To a certain extent, security will always have to make the user think. There's simply no way around that without complete service dictation.
    - chc 16y ago
      Yes, but Stack Overflow's signup screen takes more thinking than most sites (by virtue of being different, not to mention its complexity). Amazon's signup is far simpler and it does not seem to be terribly insecure.
      - Locke1689 16y ago
        Actually if you have an older Amazon account it was shown to be pretty terribly insecure.
  - Flenser 16y ago
    It can't be any harder than selecting your card type on the checkout page of every online store on the web.
    - carols10cents 16y ago
      Which is actually unnecessary since afaik you can tell what brand a card is from the first digit.
- fleitz 16y ago
  OpenID makes absolutely no sense to me. Unless they have the sites in a drop down it takes about 5 minutes to read the OpenID spec, google around for where to get the openID url and paste it into the box. OpenID is a solution in search of a problem. It may have actually been useful if it leveraged DNS SRV records so you could login as foo@bar.com and it would query SRV _openid.bar.com for the URL.
  - rmccue 16y ago
    I'm working on a spec similar to this, but using TXT records (as they're URLs, not just servers). I wonder if anyone would be interested in me putting up what I have on this already?
- jtheory 16y ago
  That flexibility is what killed me with SO. I used the site for many months after creating an account, always recognized when I returned to the site. Then one day I was signed out -- the cookie finally timed out, or was cleared somehow, etc., and I arrived at the login page, and was totally stymied. I always sign up for new services using their_domain@my_domain.tld, and that hadn't been possible here, apparently, because asking for a reminder with stackoverflow@my_domain.tld failed. Ah, I must have registered with an account at any of these half-dozen sites. Well, I have accounts at all of them -- sometimes multiple accounts for different purposes -- all using different email addresses. I had no recollection at all of which I had chosen; I was totally stymied. After a few days of trying different ways of getting in, I finally figured out the right one (still don't recall), and then could set stackoverflow@my_domain.tld as my backup email, so now I'm covered... but it was the worst sign-in experience I've ever had.
kunjaan 16y ago
>But hey, I only have about 25 years of coding and online experience. To be fair, it's not SO's fault. That was an absurd statement. Why don't you rather tell us what confuses you about the login process?
- alain94040 16y ago
  I'll give you the example of the OnStartups answers community. I am logged in on Safari, and when I go to my user page, it says my OpenID is from Yahoo. Fine. Now I open Firefox. I try to login to OnStartups, because it doesn't know who I am. I click on Yahoo, go through the authentication process. Guess what: it says it can't find that account on OnStartups (wrong answer), but finds it on StackOverflow, and asks me if I want to link it to my new account. What??? It's almost as bad as the experience I described with multiple Google accounts: http://blog.fairsoftware.net/2010/11/15/the-10-step-google-login-from-hell/ http://blog.fairsoftware.net/2010/11/15/the-10-step-google-l...
  - sesqu 16y ago
    I recently had a problem with their account management as well: SE forgot who I am, and created a new account for my e-mail address. I then recovered my original account, and ended up being logged in as different users (with identical credentials) on the normal site and the meta site. I do think the no-login approach is exactly right, but their implementation seems a little buggy.
  - codinghorror 16y ago
    Are you this Alain? http://answers.onstartups.com/users/502/alain-raynaud http://answers.onstartups.com/users/502/alain-raynaud if so then your account looks up to date to me, and you were able to log in through Facebook. Realize that this was a legacy SE 1.0 site we imported over, so your account may have had some very old stuff in it, and it may not be representative of SE 2.0 logins.
    - patio11 16y ago
      Respectfully, "We did something on the backend and now some logins no longer function" is a fairly common implementation flaw with OpenID. This is a pretty serious Oops for an identity system. The traditional username/password pair is virtually immune to this, if we assume the developers are competent. (Competence will not solve OpenID delegation, as one example. It is virtually immune to comprehension by mortal minds.) Something for other HNers to keep in mind if they are considering openID for their next project (flee, flee!)
keiferski 16y ago
UX rule #1249042: If anything on a site is ever confusing, it's always the site's fault, not the user's. So don't feel bad.
- nagnatron 16y ago
  That's one of those really silly rules, isn't it?
  - keiferski 16y ago
    Eh? It's a pretty fundamental part of usability, design, and business in general. Blaming your users is never a good idea.
    - Locke1689 16y ago
      Careful. If a user bypasses a warning dialog from the operating system to run a program they download from the Internet, is it still the OS's fault if it is malware? Sometimes providing a perfect user experience is equivalent to solving the halting problem and not recognizing this is as big a problem as believing that all problems are the user's fault.
      - deleted 16y ago
        [deleted]
      - keiferski 16y ago
        An exception can be found for every rule, in just about anything. Nitpicking specific examples and then saying "oh, well this disproves it" proves nothing. 99 out of a 100 times, blaming the user isn't the right move. For the sake of brevity, I used ever and always.
        Locke1689 16y ago
        Ah, but we're discussing a specific domain, security, where I think "the user is always right" is often wrong. Requiring a user to memorize 10+ essentially random characters, for example, is an awful user experience, but it is required for security purposes.
joe_the_user 16y ago
I've got an openID login for stackoverflow and it's a pain to constantly re-log-in. AND the orange 'welcome' pop-over is really obnoxious. I've mostly abandoned participating there after getting barely 1000 karma a year ago.

Simucal 16y ago

I can see why a non tech-savvy user would be confused by OpenID but I it surprises me how many programmers are confused by it. On the login page they list a bunch of common providers you can login with if you already have an account with them: Google, Yahoo, AOL, Facebook, etc. Click their icon, type in your credentials. If you don't have an account with one of those or don't wish to use them then it has a big register link to sign up with a myOpenID account.

chc 16y ago
You're making the same mistake as people who try to get programmers to fix their printer because programmers are "computer people." Competence with one technology does not confer instant familiarity with another — and however clear you might find OpenID, just the array of company logos alone is kind of overwhelming and highly unusual. Pretty much the opposite of "Don't make me think."
- Locke1689 16y ago
  To a certain extent, security will always have to make the user think. There's simply no way around that without complete service dictation.
  - chc 16y ago
    Yes, but Stack Overflow's signup screen takes more thinking than most sites (by virtue of being different, not to mention its complexity). Amazon's signup is far simpler and it does not seem to be terribly insecure.
    - Locke1689 16y ago
      Actually if you have an older Amazon account it was shown to be pretty terribly insecure.
- Flenser 16y ago
  It can't be any harder than selecting your card type on the checkout page of every online store on the web.
  - carols10cents 16y ago
    Which is actually unnecessary since afaik you can tell what brand a card is from the first digit.
fleitz 16y ago
OpenID makes absolutely no sense to me. Unless they have the sites in a drop down it takes about 5 minutes to read the OpenID spec, google around for where to get the openID url and paste it into the box. OpenID is a solution in search of a problem. It may have actually been useful if it leveraged DNS SRV records so you could login as foo@bar.com and it would query SRV _openid.bar.com for the URL.
- rmccue 16y ago
  I'm working on a spec similar to this, but using TXT records (as they're URLs, not just servers). I wonder if anyone would be interested in me putting up what I have on this already?
jtheory 16y ago
That flexibility is what killed me with SO. I used the site for many months after creating an account, always recognized when I returned to the site. Then one day I was signed out -- the cookie finally timed out, or was cleared somehow, etc., and I arrived at the login page, and was totally stymied. I always sign up for new services using their_domain@my_domain.tld, and that hadn't been possible here, apparently, because asking for a reminder with stackoverflow@my_domain.tld failed. Ah, I must have registered with an account at any of these half-dozen sites. Well, I have accounts at all of them -- sometimes multiple accounts for different purposes -- all using different email addresses. I had no recollection at all of which I had chosen; I was totally stymied. After a few days of trying different ways of getting in, I finally figured out the right one (still don't recall), and then could set stackoverflow@my_domain.tld as my backup email, so now I'm covered... but it was the worst sign-in experience I've ever had.

kunjaan 16y ago

>But hey, I only have about 25 years of coding and online experience. To be fair, it's not SO's fault. That was an absurd statement. Why don't you rather tell us what confuses you about the login process?

alain94040 16y ago
I'll give you the example of the OnStartups answers community. I am logged in on Safari, and when I go to my user page, it says my OpenID is from Yahoo. Fine. Now I open Firefox. I try to login to OnStartups, because it doesn't know who I am. I click on Yahoo, go through the authentication process. Guess what: it says it can't find that account on OnStartups (wrong answer), but finds it on StackOverflow, and asks me if I want to link it to my new account. What??? It's almost as bad as the experience I described with multiple Google accounts: http://blog.fairsoftware.net/2010/11/15/the-10-step-google-login-from-hell/ http://blog.fairsoftware.net/2010/11/15/the-10-step-google-l...
- sesqu 16y ago
  I recently had a problem with their account management as well: SE forgot who I am, and created a new account for my e-mail address. I then recovered my original account, and ended up being logged in as different users (with identical credentials) on the normal site and the meta site. I do think the no-login approach is exactly right, but their implementation seems a little buggy.
- codinghorror 16y ago
  Are you this Alain? http://answers.onstartups.com/users/502/alain-raynaud http://answers.onstartups.com/users/502/alain-raynaud if so then your account looks up to date to me, and you were able to log in through Facebook. Realize that this was a legacy SE 1.0 site we imported over, so your account may have had some very old stuff in it, and it may not be representative of SE 2.0 logins.
  - patio11 16y ago
    Respectfully, "We did something on the backend and now some logins no longer function" is a fairly common implementation flaw with OpenID. This is a pretty serious Oops for an identity system. The traditional username/password pair is virtually immune to this, if we assume the developers are competent. (Competence will not solve OpenID delegation, as one example. It is virtually immune to comprehension by mortal minds.) Something for other HNers to keep in mind if they are considering openID for their next project (flee, flee!)

keiferski 16y ago

UX rule #1249042: If anything on a site is ever confusing, it's always the site's fault, not the user's. So don't feel bad.

nagnatron 16y ago
That's one of those really silly rules, isn't it?
- keiferski 16y ago
  Eh? It's a pretty fundamental part of usability, design, and business in general. Blaming your users is never a good idea.
  - Locke1689 16y ago
    Careful. If a user bypasses a warning dialog from the operating system to run a program they download from the Internet, is it still the OS's fault if it is malware? Sometimes providing a perfect user experience is equivalent to solving the halting problem and not recognizing this is as big a problem as believing that all problems are the user's fault.
    - deleted 16y ago
      [deleted]
    - keiferski 16y ago
      An exception can be found for every rule, in just about anything. Nitpicking specific examples and then saying "oh, well this disproves it" proves nothing. 99 out of a 100 times, blaming the user isn't the right move. For the sake of brevity, I used ever and always.
      - Locke1689 16y ago
        Ah, but we're discussing a specific domain, security, where I think "the user is always right" is often wrong. Requiring a user to memorize 10+ essentially random characters, for example, is an awful user experience, but it is required for security purposes.

joe_the_user 16y ago

I've got an openID login for stackoverflow and it's a pain to constantly re-log-in. AND the orange 'welcome' pop-over is really obnoxious. I've mostly abandoned participating there after getting barely 1000 karma a year ago.